--- /dev/null
+From d7b76c91f471413de9ded837bddeca2164786571 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Tue, 28 Apr 2015 19:02:19 -0300
+Subject: [media] af9013: Don't accept invalid bandwidth
+
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+
+commit d7b76c91f471413de9ded837bddeca2164786571 upstream.
+
+If userspace sends an invalid bandwidth, it should either return
+EINVAL or switch to auto mode.
+
+This driver will go past an array and program the hardware on a
+wrong way if this happens.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/af9013.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/dvb-frontends/af9013.c
++++ b/drivers/media/dvb-frontends/af9013.c
+@@ -605,6 +605,10 @@ static int af9013_set_frontend(struct dv
+ }
+ }
+
++ /* Return an error if can't find bandwidth or the right clock */
++ if (i == ARRAY_SIZE(coeff_lut))
++ return -EINVAL;
++
+ ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val,
+ sizeof(coeff_lut[i].val));
+ }
--- /dev/null
+From 15575ed544910464715df5c45a44b9732e415b93 Mon Sep 17 00:00:00 2001
+From: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
+Date: Thu, 28 May 2015 14:28:12 +0100
+Subject: ASoC: arizona: Fix noise generator gain TLV
+
+From: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
+
+commit 15575ed544910464715df5c45a44b9732e415b93 upstream.
+
+The Arizona codec drivers had an incorrect dB scaling for the
+noise generator gain that started at 0dB and went upwards.
+Actually the highest setting is 0dB.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm5102.c | 2 +-
+ sound/soc/codecs/wm5110.c | 2 +-
+ sound/soc/codecs/wm8997.c | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/sound/soc/codecs/wm5102.c
++++ b/sound/soc/codecs/wm5102.c
+@@ -42,7 +42,7 @@ struct wm5102_priv {
+ static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
+ static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
+ static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
+-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
+ static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
+
+ static const struct wm_adsp_region wm5102_dsp1_regions[] = {
+--- a/sound/soc/codecs/wm5110.c
++++ b/sound/soc/codecs/wm5110.c
+@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_s
+ static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
+ static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
+ static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
+-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
+ static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
+
+ #define WM5110_NG_SRC(name, base) \
+--- a/sound/soc/codecs/wm8997.c
++++ b/sound/soc/codecs/wm8997.c
+@@ -40,7 +40,7 @@ struct wm8997_priv {
+ static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
+ static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
+ static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
+-static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
++static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
+ static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
+
+ static const struct reg_default wm8997_sysclk_reva_patch[] = {
--- /dev/null
+From 474ff0ae23b834e9fc18374d14bb5f3e7b3828b4 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 10 Jun 2015 18:37:23 +0300
+Subject: ASoC: imx-wm8962: Add a missing error check
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 474ff0ae23b834e9fc18374d14bb5f3e7b3828b4 upstream.
+
+My static checker complains that:
+
+ sound/soc/fsl/imx-wm8962.c:196 imx_wm8962_probe() warn:
+ we tested 'ret' before and it was 'false'
+
+The intent was that we use "ret" to check imx_audmux_v2_configure_port().
+
+Fixes: 8de2ae2a7f1f ('ASoC: fsl: add imx-wm8962 machine driver')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Otherwise, Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/fsl/imx-wm8962.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/fsl/imx-wm8962.c
++++ b/sound/soc/fsl/imx-wm8962.c
+@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platf
+ dev_err(&pdev->dev, "audmux internal port setup failed\n");
+ return ret;
+ }
+- imx_audmux_v2_configure_port(ext_port,
++ ret = imx_audmux_v2_configure_port(ext_port,
+ IMX_AUDMUX_V2_PTCR_SYN,
+ IMX_AUDMUX_V2_PDCR_RXDSEL(int_port));
+ if (ret) {
--- /dev/null
+From 0b51601d4504f46f585eed823485101390f0b588 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Tue, 26 May 2015 20:35:08 +0800
+Subject: ASoC: max98925: Fix mask for setting DAI invert mode
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit 0b51601d4504f46f585eed823485101390f0b588 upstream.
+
+The M98925_DAI_WCI_MASK bit is not updated with current code.
+To properly set the DAI invert mode, the mask should be
+M98925_DAI_BCI_MASK | M98925_DAI_WCI_MASK.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/max98925.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/max98925.c
++++ b/sound/soc/codecs/max98925.c
+@@ -346,7 +346,7 @@ static int max98925_dai_set_fmt(struct s
+ }
+
+ regmap_update_bits(max98925->regmap, MAX98925_FORMAT,
+- M98925_DAI_BCI_MASK, invert);
++ M98925_DAI_BCI_MASK | M98925_DAI_WCI_MASK, invert);
+ return 0;
+ }
+
--- /dev/null
+From 0574eab363ace70ef275d4caad6eadc458d33728 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 19 May 2015 14:47:32 +0200
+Subject: ASoC: omap: fix up SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency, again
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 0574eab363ace70ef275d4caad6eadc458d33728 upstream.
+
+I tried to fix this before and submitted a working patch, but after
+some discussion we came up with what seemed to be a nicer solution,
+resulting in commit 3d4cf65e2d ("ASoC: omap: fix up
+SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency"). Unfortunately, that
+version was incomplete, and we still get this build error:
+
+drivers/clk/clk-palmas.c:46:16: error: field 'hw' has incomplete type
+drivers/clk/clk-palmas.c: In function 'to_palmas_clks_info':
+drivers/clk/clk-palmas.c:54:74: warning: initialization from incompatible pointer type [-Winc
+
+This happens only in randconfig builds that turn on MFD_PALMAS
+on a platform other than OMAP2+ when COMPILE_TEST is set
+but COMMON_CLK is not.
+
+The new approach is only 'select COMMON_CLK_PALMAS' if we know
+that we are on an OMAP5 platform and MFD_PALMAS is already set.
+This patch has survived thousands of randconfig builds and I
+don't see a remaining hole in the logic.
+
+Fixes: 3d4cf65e2d ("ASoC: omap: fix up SND_OMAP_SOC_OMAP_ABE_TWL6040 dependency")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/omap/Kconfig | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/omap/Kconfig
++++ b/sound/soc/omap/Kconfig
+@@ -100,12 +100,13 @@ config SND_OMAP_SOC_OMAP_TWL4030
+
+ config SND_OMAP_SOC_OMAP_ABE_TWL6040
+ tristate "SoC Audio support for OMAP boards using ABE and twl6040 codec"
+- depends on TWL6040_CORE && SND_OMAP_SOC && (ARCH_OMAP4 || SOC_OMAP5 || COMPILE_TEST)
++ depends on TWL6040_CORE && SND_OMAP_SOC
++ depends on ARCH_OMAP4 || (SOC_OMAP5 && MFD_PALMAS) || COMPILE_TEST
+ select SND_OMAP_SOC_DMIC
+ select SND_OMAP_SOC_MCPDM
+ select SND_SOC_TWL6040
+ select SND_SOC_DMIC
+- select COMMON_CLK_PALMAS if MFD_PALMAS
++ select COMMON_CLK_PALMAS if (SOC_OMAP5 && MFD_PALMAS)
+ help
+ Say Y if you want to add support for SoC audio on OMAP boards using
+ ABE and twl6040 codec. This driver currently supports:
--- /dev/null
+From a7310c496f376b945e7e61f64d69c9c0a93ee1ee Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 21 May 2015 11:07:08 +0200
+Subject: ASoC: qcom: remove incorrect dependencies
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit a7310c496f376b945e7e61f64d69c9c0a93ee1ee upstream.
+
+Compile-tests show a warning for the newly added SND_SOC_STORM
+symbol:
+
+warning: (SND_SOC_STORM) selects SND_SOC_LPASS_CPU which has unmet direct dependencies (SOUND && !M68K && !UML && SND && SND_SOC && SND_SOC_QCOM)
+
+The problem is that it can be selected for COMPILE_TEST on non-QCOM
+builds, but the symbols it selects have a dependency.
+Dropping the dependencies makes it work without warnings and no
+other side-effects, because these are not user-visible.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: f380dd3f3cd ("ASoC: qcom: Add ability to build QCOM drivers")
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/qcom/Kconfig | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/sound/soc/qcom/Kconfig
++++ b/sound/soc/qcom/Kconfig
+@@ -6,12 +6,10 @@ config SND_SOC_QCOM
+
+ config SND_SOC_LPASS_CPU
+ tristate
+- depends on SND_SOC_QCOM
+ select REGMAP_MMIO
+
+ config SND_SOC_LPASS_PLATFORM
+ tristate
+- depends on SND_SOC_QCOM
+ select REGMAP_MMIO
+
+ config SND_SOC_STORM
--- /dev/null
+From 7ea3470a7277380248135a592a849e1c27960b2f Mon Sep 17 00:00:00 2001
+From: Nicolas Boichat <drinkcat@chromium.org>
+Date: Fri, 5 Jun 2015 18:42:12 +0800
+Subject: ASoC: rt5645: Init jack_detect_work before registering irq
+
+From: Nicolas Boichat <drinkcat@chromium.org>
+
+commit 7ea3470a7277380248135a592a849e1c27960b2f upstream.
+
+Prevents frequent panic on boot, if the irq handler rt5645_irq
+gets called before the workqueue rt5645_jack_detect_work is
+initialized.
+
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/rt5645.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -2837,6 +2837,8 @@ static int rt5645_i2c_probe(struct i2c_c
+ }
+ }
+
++ INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work);
++
+ if (rt5645->i2c->irq) {
+ ret = request_threaded_irq(rt5645->i2c->irq, NULL, rt5645_irq,
+ IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING
+@@ -2855,8 +2857,6 @@ static int rt5645_i2c_probe(struct i2c_c
+ dev_err(&i2c->dev, "Fail gpio_direction hp_det_gpio\n");
+ }
+
+- INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work);
+-
+ return snd_soc_register_codec(&i2c->dev, &soc_codec_dev_rt5645,
+ rt5645_dai, ARRAY_SIZE(rt5645_dai));
+ }
--- /dev/null
+From 1cf0f44811b754b64283b11ef0e60cb0de07b29c Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Thu, 4 Jun 2015 16:04:15 +0300
+Subject: ASoC: tas2552: Fix kernel crash caused by wrong kcontrol entry
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit 1cf0f44811b754b64283b11ef0e60cb0de07b29c upstream.
+
+SOC_DAPM_SINGLE("Playback AMP", ..) should not be under kcontrols. It
+causes kernel crash (NULL pointer) when the mixers are listed.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/tas2552.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/soc/codecs/tas2552.c
++++ b/sound/soc/codecs/tas2552.c
+@@ -338,7 +338,6 @@ static DECLARE_TLV_DB_SCALE(dac_tlv, -7,
+ static const struct snd_kcontrol_new tas2552_snd_controls[] = {
+ SOC_SINGLE_TLV("Speaker Driver Playback Volume",
+ TAS2552_PGA_GAIN, 0, 0x1f, 1, dac_tlv),
+- SOC_DAPM_SINGLE("Playback AMP", SND_SOC_NOPM, 0, 1, 0),
+ };
+
+ static const struct reg_default tas2552_init_regs[] = {
--- /dev/null
+From 80ba2669ec8c3e6517aa935001f6cb8809bf3df4 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Thu, 4 Jun 2015 16:04:14 +0300
+Subject: ASoC: tas2552: Fix kernel crash when the codec is loaded but not part of a card
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit 80ba2669ec8c3e6517aa935001f6cb8809bf3df4 upstream.
+
+If the card is not part of any card the tas_data->codec is NULL since it is
+set only during snd_soc_codec_driver.probe, which is not yet called.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/tas2552.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/soc/codecs/tas2552.c
++++ b/sound/soc/codecs/tas2552.c
+@@ -120,6 +120,9 @@ static void tas2552_sw_shutdown(struct t
+ {
+ u8 cfg1_reg;
+
++ if (!tas_data->codec)
++ return;
++
+ if (sw_shutdown)
+ cfg1_reg = 0;
+ else
--- /dev/null
+From 14ba3ec1de043260cecd9e828ea2e3a0ad302893 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Sun, 10 May 2015 11:35:06 +0800
+Subject: ASoC: wm8737: Fixup setting VMID Impedance control register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit 14ba3ec1de043260cecd9e828ea2e3a0ad302893 upstream.
+
+According to the datasheet:
+R10 (0Ah) VMID Impedance Control
+
+BIT 3:2 VMIDSEL DEFAULT 00
+
+DESCRIPTION: VMID impedance selection control
+00: 75kΩ output
+01: 300kΩ output
+10: 2.5kΩ output
+
+WM8737_VMIDSEL_MASK is 0xC (VMIDSEL - [3:2]),
+so it needs to left shift WM8737_VMIDSEL_SHIFT bits for setting these bits.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8737.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/codecs/wm8737.c
++++ b/sound/soc/codecs/wm8737.c
+@@ -483,7 +483,8 @@ static int wm8737_set_bias_level(struct
+
+ /* Fast VMID ramp at 2*2.5k */
+ snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
+- WM8737_VMIDSEL_MASK, 0x4);
++ WM8737_VMIDSEL_MASK,
++ 2 << WM8737_VMIDSEL_SHIFT);
+
+ /* Bring VMID up */
+ snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT,
+@@ -497,7 +498,8 @@ static int wm8737_set_bias_level(struct
+
+ /* VMID at 2*300k */
+ snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
+- WM8737_VMIDSEL_MASK, 2);
++ WM8737_VMIDSEL_MASK,
++ 1 << WM8737_VMIDSEL_SHIFT);
+
+ break;
+
--- /dev/null
+From ebb6ad73e645b8f2d098dd3c41d2ff0da4146a02 Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Mon, 11 May 2015 09:04:06 +0800
+Subject: ASoC: wm8903: Fix define for WM8903_VMID_RES_250K
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit ebb6ad73e645b8f2d098dd3c41d2ff0da4146a02 upstream.
+
+VMID Control 0 BIT[2:1] is VMID Divider Enable and Select
+
+00 = VMID disabled (for OFF mode)
+01 = 2 x 50kΩ divider (for normal operation)
+10 = 2 x 250kΩ divider (for low power standby)
+11 = 2 x 5kΩ divider (for fast start-up)
+
+So WM8903_VMID_RES_250K should be 2 << 1, which is 4.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8903.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8903.h
++++ b/sound/soc/codecs/wm8903.h
+@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_
+ #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */
+
+ #define WM8903_VMID_RES_50K 2
+-#define WM8903_VMID_RES_250K 3
++#define WM8903_VMID_RES_250K 4
+ #define WM8903_VMID_RES_5K 6
+
+ /*
--- /dev/null
+From 12c350050538c7dc779c083b7342bfd20f74949c Mon Sep 17 00:00:00 2001
+From: Axel Lin <axel.lin@ingics.com>
+Date: Fri, 15 May 2015 09:15:16 +0800
+Subject: ASoC: wm8955: Fix setting wrong register for WM8955_K_8_0_MASK bits
+
+From: Axel Lin <axel.lin@ingics.com>
+
+commit 12c350050538c7dc779c083b7342bfd20f74949c upstream.
+
+WM8955_K_8_0_MASK bits is controlled by WM8955_PLL_CONTROL_3 rather than
+WM8955_PLL_CONTROL_2.
+
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8955.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8955.c
++++ b/sound/soc/codecs/wm8955.c
+@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(str
+ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
+ WM8955_K_17_9_MASK,
+ (pll.k >> 9) & WM8955_K_17_9_MASK);
+- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
++ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
+ WM8955_K_8_0_MASK,
+ pll.k & WM8955_K_8_0_MASK);
+ if (pll.k)
--- /dev/null
+From a077e81ec61e07a7f86997d045109f06719fbffe Mon Sep 17 00:00:00 2001
+From: Zidan Wang <zidan.wang@freescale.com>
+Date: Thu, 11 Jun 2015 19:14:36 +0800
+Subject: ASoC: wm8960: the enum of "DAC Polarity" should be wm8960_enum[1]
+
+From: Zidan Wang <zidan.wang@freescale.com>
+
+commit a077e81ec61e07a7f86997d045109f06719fbffe upstream.
+
+the enum of "DAC Polarity" should be wm8960_enum[1].
+
+Signed-off-by: Zidan Wang <zidan.wang@freescale.com>
+Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/codecs/wm8960.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -245,7 +245,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", W
+ SOC_ENUM("ADC Polarity", wm8960_enum[0]),
+ SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
+
+-SOC_ENUM("DAC Polarity", wm8960_enum[2]),
++SOC_ENUM("DAC Polarity", wm8960_enum[1]),
+ SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
+ wm8960_get_deemph, wm8960_put_deemph),
+
--- /dev/null
+From 300f77c08ded96d33f492aaa02549103852f0c12 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@openwrt.org>
+Date: Tue, 2 Jun 2015 10:38:32 +0200
+Subject: ath9k: fix DMA stop sequence for AR9003+
+
+From: Felix Fietkau <nbd@openwrt.org>
+
+commit 300f77c08ded96d33f492aaa02549103852f0c12 upstream.
+
+AR93xx and newer needs to stop rx before tx to avoid getting the DMA
+engine or MAC into a stuck state.
+This should reduce/fix the occurence of "Failed to stop Tx DMA" logspam.
+
+Signed-off-by: Felix Fietkau <nbd@openwrt.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/main.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -216,11 +216,13 @@ static bool ath_prepare_reset(struct ath
+ ath_stop_ani(sc);
+ ath9k_hw_disable_interrupts(ah);
+
+- if (!ath_drain_all_txq(sc))
+- ret = false;
+-
+- if (!ath_stoprecv(sc))
+- ret = false;
++ if (AR_SREV_9300_20_OR_LATER(ah)) {
++ ret &= ath_stoprecv(sc);
++ ret &= ath_drain_all_txq(sc);
++ } else {
++ ret &= ath_drain_all_txq(sc);
++ ret &= ath_stoprecv(sc);
++ }
+
+ return ret;
+ }
--- /dev/null
+From 191f1aeeb93bb58e56f4d1868294ae22f3f67d4e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 14 May 2015 11:34:48 +0300
+Subject: ath9k_htc: memory corruption calling set_bit()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 191f1aeeb93bb58e56f4d1868294ae22f3f67d4e upstream.
+
+In d8a2c51cdcae ('ath9k_htc: Use atomic operations for op_flags') we
+changed things like this:
+
+- if (priv->op_flags & OP_TSF_RESET) {
++ if (test_bit(OP_TSF_RESET, &priv->op_flags)) {
+
+The problem is that test_bit() takes a bit number and not a mask. It
+means that when we do:
+
+ set_bit(OP_TSF_RESET, &priv->op_flags);
+
+Then it sets the (1 << 6) bit instead of the 6 bit so we are setting a
+bit which is past the end of the unsigned long.
+
+Fixes: d8a2c51cdcae ('ath9k_htc: Use atomic operations for op_flags')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath9k/htc.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath9k/htc.h
++++ b/drivers/net/wireless/ath/ath9k/htc.h
+@@ -440,9 +440,9 @@ static inline void ath9k_htc_stop_btcoex
+ }
+ #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
+
+-#define OP_BT_PRIORITY_DETECTED BIT(3)
+-#define OP_BT_SCAN BIT(4)
+-#define OP_TSF_RESET BIT(6)
++#define OP_BT_PRIORITY_DETECTED 3
++#define OP_BT_SCAN 4
++#define OP_TSF_RESET 6
+
+ enum htc_op_flags {
+ HTC_FWFLAG_NO_RMW,
--- /dev/null
+From 7bee8b08c428b63aa4a3765bb907602e36355378 Mon Sep 17 00:00:00 2001
+From: Chris Mason <clm@fb.com>
+Date: Tue, 14 Jul 2015 16:25:30 -0400
+Subject: Bluetooth: btbcm: allow btbcm_read_verbose_config to fail on Apple
+
+From: Chris Mason <clm@fb.com>
+
+commit 7bee8b08c428b63aa4a3765bb907602e36355378 upstream.
+
+Commit 1c8ba6d013 moved around the setup code for broadcomm chips,
+and also added btbcm_read_verbose_config() to read extra information
+about the hardware. It's returning errors on some macbooks:
+
+Bluetooth: hci0: BCM: Read verbose config info failed (-16)
+
+Which makes us error out of the setup function. Since this
+probe isn't critical to operate the chip, this patch just changes
+things to carry on when it fails.
+
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btbcm.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/bluetooth/btbcm.c
++++ b/drivers/bluetooth/btbcm.c
+@@ -378,12 +378,11 @@ int btbcm_setup_apple(struct hci_dev *hd
+
+ /* Read Verbose Config Version Info */
+ skb = btbcm_read_verbose_config(hdev);
+- if (IS_ERR(skb))
+- return PTR_ERR(skb);
+-
+- BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
+- get_unaligned_le16(skb->data + 5));
+- kfree_skb(skb);
++ if (!IS_ERR(skb)) {
++ BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
++ get_unaligned_le16(skb->data + 5));
++ kfree_skb(skb);
++ }
+
+ set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
+
--- /dev/null
+From 2eeac871697ac24a77b6d7953bd711b490e83ac7 Mon Sep 17 00:00:00 2001
+From: Aleksei Volkov <info@dv2c.ru>
+Date: Mon, 8 Jun 2015 12:02:10 +0300
+Subject: Bluetooth: btusb: Correct typo in Roper Class 1 Bluetooth Dongle
+
+From: Aleksei Volkov <info@dv2c.ru>
+
+commit 2eeac871697ac24a77b6d7953bd711b490e83ac7 upstream.
+
+That patch corrects the typo in usb vendor id for Roper Class 1 Bluetooth
+Dongle. Problem with typo is present since 4.0 kernel.
+
+Content /sys/kernel/debug/usb/devices for these dongle:
+
+T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
+D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=1310 ProdID=0001 Rev=15.00
+S: Manufacturer=SiW
+S: Product=SiW
+S: SerialNumber=E7BB050D0B00
+C:* #Ifs= 2 Cfg#= 1 Atr=a0 MxPwr= 50mA
+I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
+I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
+I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
+I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
+I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
+I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
+E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
+
+Signed-off-by: Aleksei Volkov <info@dv2c.ru>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btusb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -268,7 +268,7 @@ static const struct usb_device_id blackl
+ { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
+
+ /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
+- { USB_DEVICE(0x1300, 0x0001), .driver_info = BTUSB_SWAVE },
++ { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
+
+ /* Digianswer devices */
+ { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
--- /dev/null
+From ecffc80478cdce122f0ecb6a4e4f909132dd5c47 Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Sun, 7 Jun 2015 09:42:19 +0200
+Subject: Bluetooth: btusb: Fix memory leak in Intel setup routine
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit ecffc80478cdce122f0ecb6a4e4f909132dd5c47 upstream.
+
+The SKB returned from the Intel specific version information command is
+missing a kfree_skb.
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btusb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -1993,6 +1993,8 @@ static int btusb_setup_intel(struct hci_
+ }
+ fw_ptr = fw->data;
+
++ kfree_skb(skb);
++
+ /* This Intel specific command enables the manufacturer mode of the
+ * controller.
+ *
--- /dev/null
+From e66890a96abbb746e1229c3067471be36dc49b34 Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Sun, 7 Jun 2015 09:47:08 +0200
+Subject: Bluetooth: btusb: Fix secure send command length alignment on Intel 8260
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit e66890a96abbb746e1229c3067471be36dc49b34 upstream.
+
+This patch fixes the command length alignment issue for Intel Bluetooth
+8260.
+
+The length of parameters in the firmware downloading command must be
+multiplication of 4. If not, the command must append Intel_NOP command
+with extra parameters, zeros, at the end, and the firmware file is
+already included Intel_NOP command for alignment.
+
+This patch checks the next command and if the next command is Intel_NOP
+command, it reads the Intel_NOP command and send them together.
+
+For example, if the data from the firmware file looks like this:
+8E FC 03 11 22 33 02 FC 03 00 00 00
+
+Previously, btusb sends two commands:
+09 FC 06 8E FC 03 11 22 33
+09 FC 06 02 FC 03 00 00 00
+
+This won't work because the length of parameters are 6 which violates
+the 4 byte alignment.
+
+This patch will append them together and send as one command:
+09 FC 0C 8E FC 03 11 22 33 02 FC 03 00 00 00
+
+Based on previous work from Tedd Ho-Jeong An <tedd.an@intel.com>
+
+Reported-by: Tedd Ho-Jeong An <tedd.an@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Tested-by: Tedd Ho-Jeong An <tedd.an@intel.com>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bluetooth/btusb.c | 34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -2336,6 +2336,7 @@ static int btusb_setup_intel_new(struct
+ struct intel_boot_params *params;
+ const struct firmware *fw;
+ const u8 *fw_ptr;
++ u32 frag_len;
+ char fwname[64];
+ ktime_t calltime, delta, rettime;
+ unsigned long long duration;
+@@ -2542,24 +2543,33 @@ static int btusb_setup_intel_new(struct
+ }
+
+ fw_ptr = fw->data + 644;
++ frag_len = 0;
+
+ while (fw_ptr - fw->data < fw->size) {
+- struct hci_command_hdr *cmd = (void *)fw_ptr;
+- u8 cmd_len;
++ struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
+
+- cmd_len = sizeof(*cmd) + cmd->plen;
++ frag_len += sizeof(*cmd) + cmd->plen;
+
+- /* Send each command from the firmware data buffer as
+- * a single Data fragment.
++ /* The paramter length of the secure send command requires
++ * a 4 byte alignment. It happens so that the firmware file
++ * contains proper Intel_NOP commands to align the fragments
++ * as needed.
++ *
++ * Send set of commands with 4 byte alignment from the
++ * firmware data buffer as a single Data fragement.
+ */
+- err = btusb_intel_secure_send(hdev, 0x01, cmd_len, fw_ptr);
+- if (err < 0) {
+- BT_ERR("%s: Failed to send firmware data (%d)",
+- hdev->name, err);
+- goto done;
+- }
++ if (!(frag_len % 4)) {
++ err = btusb_intel_secure_send(hdev, 0x01, frag_len,
++ fw_ptr);
++ if (err < 0) {
++ BT_ERR("%s: Failed to send firmware data (%d)",
++ hdev->name, err);
++ goto done;
++ }
+
+- fw_ptr += cmd_len;
++ fw_ptr += frag_len;
++ frag_len = 0;
++ }
+ }
+
+ set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
--- /dev/null
+From 781f899f2f9d8b71e35225a087f90052059486c5 Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Sat, 6 Jun 2015 06:06:49 +0200
+Subject: Bluetooth: Fix race condition with user channel and setup stage
+
+From: Marcel Holtmann <marcel@holtmann.org>
+
+commit 781f899f2f9d8b71e35225a087f90052059486c5 upstream.
+
+During the initial setup stage of a controller, the low-level transport
+is actually active. This means that HCI_UP is true. To avoid toggling
+the transport off and back on again for normal operation the kernel
+holds a grace period with HCI_AUTO_OFF that will turn the low-level
+transport off in case no user is present.
+
+The idea of the grace period is important to avoid having to initialize
+all of the controller twice. So legacy ioctl and the new management
+interface knows how to clear this grace period and then start normal
+operation.
+
+For the user channel operation this grace period has not been taken into
+account which results in the problem that HCI_UP and HCI_AUTO_OFF are
+set and the kernel will return EBUSY. However from a system point of
+view the controller is ready to be grabbed by either the ioctl, the
+management interface or the user channel.
+
+This patch brings the user channel to the same level as the other two
+entries for operating a controller.
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/hci_sock.c | 26 +++++++++++++++++++-------
+ 1 file changed, 19 insertions(+), 7 deletions(-)
+
+--- a/net/bluetooth/hci_sock.c
++++ b/net/bluetooth/hci_sock.c
+@@ -741,10 +741,11 @@ static int hci_sock_bind(struct socket *
+ goto done;
+ }
+
+- if (test_bit(HCI_UP, &hdev->flags) ||
+- test_bit(HCI_INIT, &hdev->flags) ||
++ if (test_bit(HCI_INIT, &hdev->flags) ||
+ hci_dev_test_flag(hdev, HCI_SETUP) ||
+- hci_dev_test_flag(hdev, HCI_CONFIG)) {
++ hci_dev_test_flag(hdev, HCI_CONFIG) ||
++ (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
++ test_bit(HCI_UP, &hdev->flags))) {
+ err = -EBUSY;
+ hci_dev_put(hdev);
+ goto done;
+@@ -760,10 +761,21 @@ static int hci_sock_bind(struct socket *
+
+ err = hci_dev_open(hdev->id);
+ if (err) {
+- hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
+- mgmt_index_added(hdev);
+- hci_dev_put(hdev);
+- goto done;
++ if (err == -EALREADY) {
++ /* In case the transport is already up and
++ * running, clear the error here.
++ *
++ * This can happen when opening an user
++ * channel and HCI_AUTO_OFF grace period
++ * is still active.
++ */
++ err = 0;
++ } else {
++ hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
++ mgmt_index_added(hdev);
++ hci_dev_put(hdev);
++ goto done;
++ }
+ }
+
+ atomic_inc(&hdev->promisc);
--- /dev/null
+From bd7ade3cd9b0850264306f5c2b79024a417b6396 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <kernel@kyup.com>
+Date: Thu, 2 Jul 2015 01:32:44 -0400
+Subject: bufferhead: Add _gfp version for sb_getblk()
+
+From: Nikolay Borisov <kernel@kyup.com>
+
+commit bd7ade3cd9b0850264306f5c2b79024a417b6396 upstream.
+
+sb_getblk() is used during ext4 (and possibly other FSes) writeback
+paths. Sometimes such path require allocating memory and guaranteeing
+that such allocation won't block. Currently, however, there is no way
+to provide user flags for sb_getblk which could lead to deadlocks.
+
+This patch implements a sb_getblk_gfp with the only difference it can
+accept user-provided GFP flags.
+
+Signed-off-by: Nikolay Borisov <kernel@kyup.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/buffer_head.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/include/linux/buffer_head.h
++++ b/include/linux/buffer_head.h
+@@ -317,6 +317,13 @@ sb_getblk(struct super_block *sb, sector
+ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
+ }
+
++
++static inline struct buffer_head *
++sb_getblk_gfp(struct super_block *sb, sector_t block, gfp_t gfp)
++{
++ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, gfp);
++}
++
+ static inline struct buffer_head *
+ sb_find_get_block(struct super_block *sb, sector_t block)
+ {
--- /dev/null
+From 2b4fd3ede3bab65ef5b97387b90899d11e4d3202 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Fri, 24 Apr 2015 03:55:07 -0300
+Subject: [media] cx18: add missing caps for the PCM video device
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 2b4fd3ede3bab65ef5b97387b90899d11e4d3202 upstream.
+
+The cx18 PCM video device didn't have any capabilities set, which caused a warnings
+in the v4l2 core:
+
+[ 6.229393] ------------[ cut here ]------------
+[ 6.229414] WARNING: CPU: 1 PID: 593 at
+drivers/media/v4l2-core/v4l2-ioctl.c:1025 v4l_querycap+0x41/0x70
+[videodev]()
+[ 6.229415] Modules linked in: cx18_alsa mxl5005s s5h1409
+tuner_simple tuner_types cs5345 tuner intel_rapl iosf_mbi
+x86_pkg_temp_thermal coretemp raid1 snd_hda_codec_realtek kvm_intel
+snd_hda_codec_generic snd_hda_codec_hdmi kvm snd_oxygen(+) snd_hda_intel
+snd_oxygen_lib snd_hda_controller snd_hda_codec snd_mpu401_uart iTCO_wdt
+snd_rawmidi iTCO_vendor_support snd_hwdep crct10dif_pclmul crc32_pclmul
+crc32c_intel snd_seq cx18 snd_seq_device ghash_clmulni_intel
+videobuf_vmalloc tveeprom cx2341x snd_pcm serio_raw videobuf_core vfat
+dvb_core fat v4l2_common snd_timer videodev snd lpc_ich i2c_i801 joydev
+mfd_core mei_me media soundcore tpm_infineon soc_button_array tpm_tis
+mei shpchp tpm nfsd auth_rpcgss nfs_acl lockd grace sunrpc binfmt_misc
+i915 nouveau mxm_wmi wmi e1000e ttm i2c_algo_bit drm_kms_helper
+[ 6.229444] drm ptp pps_core video
+[ 6.229446] CPU: 1 PID: 593 Comm: v4l_id Not tainted
+3.19.3-200.fc21.x86_64 #1
+[ 6.229447] Hardware name: Gigabyte Technology Co., Ltd.
+Z87-D3HP/Z87-D3HP-CF, BIOS F6 01/20/2014
+[ 6.229448] 0000000000000000 00000000d12b1131 ffff88042dacfc28
+ffffffff8176e215
+[ 6.229449] 0000000000000000 0000000000000000 ffff88042dacfc68
+ffffffff8109bc1a
+[ 6.229451] ffffffffa0594000 ffff88042dacfd90 0000000000000000
+ffffffffa04e2140
+[ 6.229452] Call Trace:
+[ 6.229466] [<ffffffff8176e215>] dump_stack+0x45/0x57
+[ 6.229469] [<ffffffff8109bc1a>] warn_slowpath_common+0x8a/0xc0
+[ 6.229472] [<ffffffff8109bd4a>] warn_slowpath_null+0x1a/0x20
+[ 6.229474] [<ffffffffa04ca401>] v4l_querycap+0x41/0x70 [videodev]
+[ 6.229477] [<ffffffffa04ca6cc>] __video_do_ioctl+0x29c/0x320 [videodev]
+[ 6.229479] [<ffffffff81227131>] ? do_last+0x2f1/0x1210
+[ 6.229491] [<ffffffffa04cc776>] video_usercopy+0x366/0x5d0 [videodev]
+[ 6.229494] [<ffffffffa04ca430>] ? v4l_querycap+0x70/0x70 [videodev]
+[ 6.229497] [<ffffffffa04cc9f5>] video_ioctl2+0x15/0x20 [videodev]
+[ 6.229499] [<ffffffffa04c6794>] v4l2_ioctl+0x164/0x180 [videodev]
+[ 6.229501] [<ffffffff8122e298>] do_vfs_ioctl+0x2f8/0x500
+[ 6.229502] [<ffffffff8122e521>] SyS_ioctl+0x81/0xa0
+[ 6.229505] [<ffffffff81774a09>] system_call_fastpath+0x12/0x17
+[ 6.229506] ---[ end trace dacd80d4b19277ea ]---
+
+Added the necessary capabilities to stop this warning.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Reported-by: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/pci/cx18/cx18-streams.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/pci/cx18/cx18-streams.c
++++ b/drivers/media/pci/cx18/cx18-streams.c
+@@ -90,6 +90,7 @@ static struct {
+ "encoder PCM audio",
+ VFL_TYPE_GRABBER, CX18_V4L2_ENC_PCM_OFFSET,
+ PCI_DMA_FROMDEVICE,
++ V4L2_CAP_TUNER | V4L2_CAP_AUDIO | V4L2_CAP_READWRITE,
+ },
+ { /* CX18_ENC_STREAM_TYPE_IDX */
+ "encoder IDX",
--- /dev/null
+From 1fa2337a315a2448c5434f41e00d56b01a22283c Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Tue, 28 Apr 2015 18:51:17 -0300
+Subject: [media] cx24116: fix a buffer overflow when checking userspace params
+
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+
+commit 1fa2337a315a2448c5434f41e00d56b01a22283c upstream.
+
+The maximum size for a DiSEqC command is 6, according to the
+userspace API. However, the code allows to write up much more values:
+ drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/cx24116.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/dvb-frontends/cx24116.c
++++ b/drivers/media/dvb-frontends/cx24116.c
+@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struc
+ struct cx24116_state *state = fe->demodulator_priv;
+ int i, ret;
+
++ /* Validate length */
++ if (d->msg_len > sizeof(d->msg))
++ return -EINVAL;
++
+ /* Dump DiSEqC message */
+ if (debug) {
+ printk(KERN_INFO "cx24116: %s(", __func__);
+@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struc
+ printk(") toneburst=%d\n", toneburst);
+ }
+
+- /* Validate length */
+- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
+- return -EINVAL;
+-
+ /* DiSEqC message */
+ for (i = 0; i < d->msg_len; i++)
+ state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
--- /dev/null
+From 82e3b88b679049f043fe9b03991d6d66fc0a43c8 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Tue, 28 Apr 2015 19:03:59 -0300
+Subject: [media] cx24117: fix a buffer overflow when checking userspace params
+
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+
+commit 82e3b88b679049f043fe9b03991d6d66fc0a43c8 upstream.
+
+The maximum size for a DiSEqC command is 6, according to the
+userspace API. However, the code allows to write up much more values:
+ drivers/media/dvb-frontends/cx24116.c:983 cx24116_send_diseqc_msg() error: buffer overflow 'd->msg' 6 <= 23
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/cx24117.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/dvb-frontends/cx24117.c
++++ b/drivers/media/dvb-frontends/cx24117.c
+@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struc
+ dev_dbg(&state->priv->i2c->dev, ")\n");
+
+ /* Validate length */
+- if (d->msg_len > 15)
++ if (d->msg_len > sizeof(d->msg))
+ return -EINVAL;
+
+ /* DiSEqC message */
--- /dev/null
+From c45653c341f5c8a0ce19c8f0ad4678640849cb86 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <kernel@kyup.com>
+Date: Thu, 2 Jul 2015 01:34:07 -0400
+Subject: ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp
+
+From: Nikolay Borisov <kernel@kyup.com>
+
+commit c45653c341f5c8a0ce19c8f0ad4678640849cb86 upstream.
+
+Switch ext4 to using sb_getblk_gfp with GFP_NOFS added to fix possible
+deadlocks in the page writeback path.
+
+Signed-off-by: Nikolay Borisov <kernel@kyup.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/extents.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -503,7 +503,7 @@ __read_extent_tree_block(const char *fun
+ struct buffer_head *bh;
+ int err;
+
+- bh = sb_getblk(inode->i_sb, pblk);
++ bh = sb_getblk_gfp(inode->i_sb, pblk, __GFP_MOVABLE | GFP_NOFS);
+ if (unlikely(!bh))
+ return ERR_PTR(-ENOMEM);
+
+@@ -1088,7 +1088,7 @@ static int ext4_ext_split(handle_t *hand
+ err = -EIO;
+ goto cleanup;
+ }
+- bh = sb_getblk(inode->i_sb, newblock);
++ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
+ if (unlikely(!bh)) {
+ err = -ENOMEM;
+ goto cleanup;
+@@ -1282,7 +1282,7 @@ static int ext4_ext_grow_indepth(handle_
+ if (newblock == 0)
+ return err;
+
+- bh = sb_getblk(inode->i_sb, newblock);
++ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
+ if (unlikely(!bh))
+ return -ENOMEM;
+ lock_buffer(bh);
--- /dev/null
+From d6f123a9297496ad0b6335fe881504c4b5b2a5e5 Mon Sep 17 00:00:00 2001
+From: Eryu Guan <guaneryu@gmail.com>
+Date: Fri, 3 Jul 2015 23:56:50 -0400
+Subject: ext4: be more strict when migrating to non-extent based file
+
+From: Eryu Guan <guaneryu@gmail.com>
+
+commit d6f123a9297496ad0b6335fe881504c4b5b2a5e5 upstream.
+
+Currently the check in ext4_ind_migrate() is not enough before doing the
+real conversion:
+
+a) delayed allocated extents could bypass the check on eh->eh_entries
+ and eh->eh_depth
+
+This can be demonstrated by this script
+
+ xfs_io -fc "pwrite 0 4k" -c "pwrite 8k 4k" /mnt/ext4/testfile
+ chattr -e /mnt/ext4/testfile
+
+where testfile has two extents but still be converted to non-extent
+based file format.
+
+b) only extent length is checked but not the offset, which would result
+ in data lose (delalloc) or fs corruption (nodelalloc), because
+ non-extent based file only supports at most (12 + 2^10 + 2^20 + 2^30)
+ blocks
+
+This can be demostrated by
+
+ xfs_io -fc "pwrite 5T 4k" /mnt/ext4/testfile
+ chattr -e /mnt/ext4/testfile
+ sync
+
+If delalloc is enabled, dmesg prints
+ EXT4-fs warning (device dm-4): ext4_block_to_path:105: block 1342177280 > max in inode 53
+ EXT4-fs (dm-4): Delayed block allocation failed for inode 53 at logical offset 1342177280 with max blocks 1 with error 5
+ EXT4-fs (dm-4): This should not happen!! Data will be lost
+
+If delalloc is disabled, e2fsck -nf shows corruption
+ Inode 53, i_size is 5497558142976, should be 4096. Fix? no
+
+Fix the two issues by
+
+a) forcing all delayed allocation blocks to be allocated before checking
+ eh->eh_depth and eh->eh_entries
+b) limiting the last logical block of the extent is within direct map
+
+Signed-off-by: Eryu Guan <guaneryu@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/migrate.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -620,6 +620,7 @@ int ext4_ind_migrate(struct inode *inode
+ struct ext4_inode_info *ei = EXT4_I(inode);
+ struct ext4_extent *ex;
+ unsigned int i, len;
++ ext4_lblk_t end;
+ ext4_fsblk_t blk;
+ handle_t *handle;
+ int ret;
+@@ -633,6 +634,14 @@ int ext4_ind_migrate(struct inode *inode
+ EXT4_FEATURE_RO_COMPAT_BIGALLOC))
+ return -EOPNOTSUPP;
+
++ /*
++ * In order to get correct extent info, force all delayed allocation
++ * blocks to be allocated, otherwise delayed allocation blocks may not
++ * be reflected and bypass the checks on extent header.
++ */
++ if (test_opt(inode->i_sb, DELALLOC))
++ ext4_alloc_da_blocks(inode);
++
+ handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
+ if (IS_ERR(handle))
+ return PTR_ERR(handle);
+@@ -654,7 +663,8 @@ int ext4_ind_migrate(struct inode *inode
+ else {
+ len = le16_to_cpu(ex->ee_len);
+ blk = ext4_ext_pblock(ex);
+- if (len > EXT4_NDIR_BLOCKS) {
++ end = le32_to_cpu(ex->ee_block) + len - 1;
++ if (end >= EXT4_NDIR_BLOCKS) {
+ ret = -EOPNOTSUPP;
+ goto errout;
+ }
--- /dev/null
+From 89d96a6f8e6491f24fc8f99fd6ae66820e85c6c1 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Sat, 20 Jun 2015 22:50:33 -0400
+Subject: ext4: call sync_blockdev() before invalidate_bdev() in put_super()
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 89d96a6f8e6491f24fc8f99fd6ae66820e85c6c1 upstream.
+
+Normally all of the buffers will have been forced out to disk before
+we call invalidate_bdev(), but there will be some cases, where a file
+system operation was aborted due to an ext4_error(), where there may
+still be some dirty buffers in the buffer cache for the device. So
+try to force them out to memory before calling invalidate_bdev().
+
+This fixes a warning triggered by generic/081:
+
+WARNING: CPU: 1 PID: 3473 at /usr/projects/linux/ext4/fs/block_dev.c:56 __blkdev_put+0xb5/0x16f()
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -807,6 +807,7 @@ static void ext4_put_super(struct super_
+ dump_orphan_list(sb, sbi);
+ J_ASSERT(list_empty(&sbi->s_orphan));
+
++ sync_blockdev(sb->s_bdev);
+ invalidate_bdev(sb->s_bdev);
+ if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
+ /*
--- /dev/null
+From 8974fec7d72e3e02752fe0f27b4c3719c78d9a15 Mon Sep 17 00:00:00 2001
+From: Eryu Guan <guaneryu@gmail.com>
+Date: Sat, 4 Jul 2015 00:03:44 -0400
+Subject: ext4: correctly migrate a file with a hole at the beginning
+
+From: Eryu Guan <guaneryu@gmail.com>
+
+commit 8974fec7d72e3e02752fe0f27b4c3719c78d9a15 upstream.
+
+Currently ext4_ind_migrate() doesn't correctly handle a file which
+contains a hole at the beginning of the file. This caused the migration
+to be done incorrectly, and then if there is a subsequent following
+delayed allocation write to the "hole", this would reclaim the same data
+blocks again and results in fs corruption.
+
+ # assmuing 4k block size ext4, with delalloc enabled
+ # skip the first block and write to the second block
+ xfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/ext4/testfile
+
+ # converting to indirect-mapped file, which would move the data blocks
+ # to the beginning of the file, but extent status cache still marks
+ # that region as a hole
+ chattr -e /mnt/ext4/testfile
+
+ # delayed allocation writes to the "hole", reclaim the same data block
+ # again, results in i_blocks corruption
+ xfs_io -c "pwrite 0 4k" /mnt/ext4/testfile
+ umount /mnt/ext4
+ e2fsck -nf /dev/sda6
+ ...
+ Inode 53, i_blocks is 16, should be 8. Fix? no
+ ...
+
+Signed-off-by: Eryu Guan <guaneryu@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/migrate.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/fs/ext4/migrate.c
++++ b/fs/ext4/migrate.c
+@@ -620,7 +620,7 @@ int ext4_ind_migrate(struct inode *inode
+ struct ext4_inode_info *ei = EXT4_I(inode);
+ struct ext4_extent *ex;
+ unsigned int i, len;
+- ext4_lblk_t end;
++ ext4_lblk_t start, end;
+ ext4_fsblk_t blk;
+ handle_t *handle;
+ int ret;
+@@ -659,11 +659,12 @@ int ext4_ind_migrate(struct inode *inode
+ goto errout;
+ }
+ if (eh->eh_entries == 0)
+- blk = len = 0;
++ blk = len = start = end = 0;
+ else {
+ len = le16_to_cpu(ex->ee_len);
+ blk = ext4_ext_pblock(ex);
+- end = le32_to_cpu(ex->ee_block) + len - 1;
++ start = le32_to_cpu(ex->ee_block);
++ end = start + len - 1;
+ if (end >= EXT4_NDIR_BLOCKS) {
+ ret = -EOPNOTSUPP;
+ goto errout;
+@@ -672,7 +673,7 @@ int ext4_ind_migrate(struct inode *inode
+
+ ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
+ memset(ei->i_data, 0, sizeof(ei->i_data));
+- for (i=0; i < len; i++)
++ for (i = start; i <= end; i++)
+ ei->i_data[i] = cpu_to_le32(blk++);
+ ext4_mark_inode_dirty(handle, inode);
+ errout:
--- /dev/null
+From 292db1bc6c105d86111e858859456bcb11f90f91 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Sun, 21 Jun 2015 21:10:51 -0400
+Subject: ext4: don't retry file block mapping on bigalloc fs with non-extent file
+
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+
+commit 292db1bc6c105d86111e858859456bcb11f90f91 upstream.
+
+ext4 isn't willing to map clusters to a non-extent file. Don't signal
+this with an out of space error, since the FS will retry the
+allocation (which didn't fail) forever. Instead, return EUCLEAN so
+that the operation will fail immediately all the way back to userspace.
+
+(The fix is either to run e2fsck -E bmap2extent, or to chattr +e the file.)
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/indirect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ext4/indirect.c
++++ b/fs/ext4/indirect.c
+@@ -565,7 +565,7 @@ int ext4_ind_map_blocks(handle_t *handle
+ EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
+ EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
+ "non-extent mapped inodes with bigalloc");
+- return -ENOSPC;
++ return -EUCLEAN;
+ }
+
+ /* Set up for the direct block allocation */
--- /dev/null
+From 0f0ff9a9f3fa2ec6f427603fd521d5f3a0b076d1 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 1 Jul 2015 23:37:46 -0400
+Subject: ext4: fix fencepost error in lazytime optimization
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit 0f0ff9a9f3fa2ec6f427603fd521d5f3a0b076d1 upstream.
+
+Commit 8f4d8558391: "ext4: fix lazytime optimization" was not a
+complete fix. In the case where the inode number is a multiple of 16,
+and we could still end up updating an inode with dirty timestamps
+written to the wrong inode on disk. Oops.
+
+This can be easily reproduced by using generic/005 with a file system
+with metadata_csum and lazytime enabled.
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/inode.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -4360,7 +4360,12 @@ static void ext4_update_other_inodes_tim
+ int inode_size = EXT4_INODE_SIZE(sb);
+
+ oi.orig_ino = orig_ino;
+- ino = (orig_ino & ~(inodes_per_block - 1)) + 1;
++ /*
++ * Calculate the first inode in the inode table block. Inode
++ * numbers are one-based. That is, the first inode in a block
++ * (assuming 4k blocks and 256 byte inodes) is (n*16 + 1).
++ */
++ ino = ((orig_ino - 1) & ~(inodes_per_block - 1)) + 1;
+ for (i = 0; i < inodes_per_block; i++, ino++, buf += inode_size) {
+ if (ino == orig_ino)
+ continue;
--- /dev/null
+From bdf96838aea6a265f2ae6cbcfb12a778c84a0b8e Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Fri, 12 Jun 2015 23:45:33 -0400
+Subject: ext4: fix race between truncate and __ext4_journalled_writepage()
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit bdf96838aea6a265f2ae6cbcfb12a778c84a0b8e upstream.
+
+The commit cf108bca465d: "ext4: Invert the locking order of page_lock
+and transaction start" caused __ext4_journalled_writepage() to drop
+the page lock before the page was written back, as part of changing
+the locking order to jbd2_journal_start -> page_lock. However, this
+introduced a potential race if there was a truncate racing with the
+data=journalled writeback mode.
+
+Fix this by grabbing the page lock after starting the journal handle,
+and then checking to see if page had gotten truncated out from under
+us.
+
+This fixes a number of different warnings or BUG_ON's when running
+xfstests generic/086 in data=journalled mode, including:
+
+jbd2_journal_dirty_metadata: vdc-8: bad jh for block 115643: transaction (ee3fe7
+c0, 164), jh->b_transaction ( (null), 0), jh->b_next_transaction ( (null), 0), jlist 0
+
+ - and -
+
+kernel BUG at /usr/projects/linux/ext4/fs/jbd2/transaction.c:2200!
+ ...
+Call Trace:
+ [<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117
+ [<c02b2de5>] __ext4_journalled_invalidatepage+0x10f/0x117
+ [<c02b2ded>] ? __ext4_journalled_invalidatepage+0x117/0x117
+ [<c027d883>] ? lock_buffer+0x36/0x36
+ [<c02b2dfa>] ext4_journalled_invalidatepage+0xd/0x22
+ [<c0229139>] do_invalidatepage+0x22/0x26
+ [<c0229198>] truncate_inode_page+0x5b/0x85
+ [<c022934b>] truncate_inode_pages_range+0x156/0x38c
+ [<c0229592>] truncate_inode_pages+0x11/0x15
+ [<c022962d>] truncate_pagecache+0x55/0x71
+ [<c02b913b>] ext4_setattr+0x4a9/0x560
+ [<c01ca542>] ? current_kernel_time+0x10/0x44
+ [<c026c4d8>] notify_change+0x1c7/0x2be
+ [<c0256a00>] do_truncate+0x65/0x85
+ [<c0226f31>] ? file_ra_state_init+0x12/0x29
+
+ - and -
+
+WARNING: CPU: 1 PID: 1331 at /usr/projects/linux/ext4/fs/jbd2/transaction.c:1396
+irty_metadata+0x14a/0x1ae()
+ ...
+Call Trace:
+ [<c01b879f>] ? console_unlock+0x3a1/0x3ce
+ [<c082cbb4>] dump_stack+0x48/0x60
+ [<c0178b65>] warn_slowpath_common+0x89/0xa0
+ [<c02ef2cf>] ? jbd2_journal_dirty_metadata+0x14a/0x1ae
+ [<c0178bef>] warn_slowpath_null+0x14/0x18
+ [<c02ef2cf>] jbd2_journal_dirty_metadata+0x14a/0x1ae
+ [<c02d8615>] __ext4_handle_dirty_metadata+0xd4/0x19d
+ [<c02b2f44>] write_end_fn+0x40/0x53
+ [<c02b4a16>] ext4_walk_page_buffers+0x4e/0x6a
+ [<c02b59e7>] ext4_writepage+0x354/0x3b8
+ [<c02b2f04>] ? mpage_release_unused_pages+0xd4/0xd4
+ [<c02b1b21>] ? wait_on_buffer+0x2c/0x2c
+ [<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8
+ [<c02b5a5b>] __writepage+0x10/0x2e
+ [<c0225956>] write_cache_pages+0x22d/0x32c
+ [<c02b5a4b>] ? ext4_writepage+0x3b8/0x3b8
+ [<c02b6ee8>] ext4_writepages+0x102/0x607
+ [<c019adfe>] ? sched_clock_local+0x10/0x10e
+ [<c01a8a7c>] ? __lock_is_held+0x2e/0x44
+ [<c01a8ad5>] ? lock_is_held+0x43/0x51
+ [<c0226dff>] do_writepages+0x1c/0x29
+ [<c0276bed>] __writeback_single_inode+0xc3/0x545
+ [<c0277c07>] writeback_sb_inodes+0x21f/0x36d
+ ...
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/inode.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1701,19 +1701,32 @@ static int __ext4_journalled_writepage(s
+ ext4_walk_page_buffers(handle, page_bufs, 0, len,
+ NULL, bget_one);
+ }
+- /* As soon as we unlock the page, it can go away, but we have
+- * references to buffers so we are safe */
++ /*
++ * We need to release the page lock before we start the
++ * journal, so grab a reference so the page won't disappear
++ * out from under us.
++ */
++ get_page(page);
+ unlock_page(page);
+
+ handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
+ ext4_writepage_trans_blocks(inode));
+ if (IS_ERR(handle)) {
+ ret = PTR_ERR(handle);
+- goto out;
++ put_page(page);
++ goto out_no_pagelock;
+ }
+-
+ BUG_ON(!ext4_handle_valid(handle));
+
++ lock_page(page);
++ put_page(page);
++ if (page->mapping != mapping) {
++ /* The page got truncated from under us */
++ ext4_journal_stop(handle);
++ ret = 0;
++ goto out;
++ }
++
+ if (inline_data) {
+ BUFFER_TRACE(inode_bh, "get write access");
+ ret = ext4_journal_get_write_access(handle, inode_bh);
+@@ -1739,6 +1752,8 @@ static int __ext4_journalled_writepage(s
+ NULL, bput_one);
+ ext4_set_inode_state(inode, EXT4_STATE_JDATA);
+ out:
++ unlock_page(page);
++out_no_pagelock:
+ brelse(inode_bh);
+ return ret;
+ }
--- /dev/null
+From 9705acd63b125dee8b15c705216d7186daea4625 Mon Sep 17 00:00:00 2001
+From: Lukas Czerner <lczerner@redhat.com>
+Date: Fri, 3 Jul 2015 21:13:55 -0400
+Subject: ext4: fix reservation release on invalidatepage for delalloc fs
+
+From: Lukas Czerner <lczerner@redhat.com>
+
+commit 9705acd63b125dee8b15c705216d7186daea4625 upstream.
+
+On delalloc enabled file system on invalidatepage operation
+in ext4_da_page_release_reservation() we want to clear the delayed
+buffer and remove the extent covering the delayed buffer from the extent
+status tree.
+
+However currently there is a bug where on the systems with page size >
+block size we will always remove extents from the start of the page
+regardless where the actual delayed buffers are positioned in the page.
+This leads to the errors like this:
+
+EXT4-fs warning (device loop0): ext4_da_release_space:1225:
+ext4_da_release_space: ino 13, to_free 1 with only 0 reserved data
+blocks
+
+This however can cause data loss on writeback time if the file system is
+in ENOSPC condition because we're releasing reservation for someones
+else delayed buffer.
+
+Fix this by only removing extents that corresponds to the part of the
+page we want to invalidate.
+
+This problem is reproducible by the following fio receipt (however I was
+only able to reproduce it with fio-2.1 or older.
+
+[global]
+bs=8k
+iodepth=1024
+iodepth_batch=60
+randrepeat=1
+size=1m
+directory=/mnt/test
+numjobs=20
+[job1]
+ioengine=sync
+bs=1k
+direct=1
+rw=randread
+filename=file1:file2
+[job2]
+ioengine=libaio
+rw=randwrite
+direct=1
+filename=file1:file2
+[job3]
+bs=1k
+ioengine=posixaio
+rw=randwrite
+direct=1
+filename=file1:file2
+[job5]
+bs=1k
+ioengine=sync
+rw=randread
+filename=file1:file2
+[job7]
+ioengine=libaio
+rw=randwrite
+filename=file1:file2
+[job8]
+ioengine=posixaio
+rw=randwrite
+filename=file1:file2
+[job10]
+ioengine=mmap
+rw=randwrite
+bs=1k
+filename=file1:file2
+[job11]
+ioengine=mmap
+rw=randwrite
+direct=1
+filename=file1:file2
+
+Signed-off-by: Lukas Czerner <lczerner@redhat.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/inode.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1342,7 +1342,7 @@ static void ext4_da_page_release_reserva
+ unsigned int offset,
+ unsigned int length)
+ {
+- int to_release = 0;
++ int to_release = 0, contiguous_blks = 0;
+ struct buffer_head *head, *bh;
+ unsigned int curr_off = 0;
+ struct inode *inode = page->mapping->host;
+@@ -1363,14 +1363,23 @@ static void ext4_da_page_release_reserva
+
+ if ((offset <= curr_off) && (buffer_delay(bh))) {
+ to_release++;
++ contiguous_blks++;
+ clear_buffer_delay(bh);
++ } else if (contiguous_blks) {
++ lblk = page->index <<
++ (PAGE_CACHE_SHIFT - inode->i_blkbits);
++ lblk += (curr_off >> inode->i_blkbits) -
++ contiguous_blks;
++ ext4_es_remove_extent(inode, lblk, contiguous_blks);
++ contiguous_blks = 0;
+ }
+ curr_off = next_off;
+ } while ((bh = bh->b_this_page) != head);
+
+- if (to_release) {
++ if (contiguous_blks) {
+ lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
+- ext4_es_remove_extent(inode, lblk, to_release);
++ lblk += (curr_off >> inode->i_blkbits) - contiguous_blks;
++ ext4_es_remove_extent(inode, lblk, contiguous_blks);
+ }
+
+ /* If we have released all the blocks belonging to a cluster, then we
--- /dev/null
+From 7444a072c387a93ebee7066e8aee776954ab0e41 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.cz>
+Date: Sun, 5 Jul 2015 12:33:44 -0400
+Subject: ext4: replace open coded nofail allocation in ext4_free_blocks()
+
+From: Michal Hocko <mhocko@suse.cz>
+
+commit 7444a072c387a93ebee7066e8aee776954ab0e41 upstream.
+
+ext4_free_blocks is looping around the allocation request and mimics
+__GFP_NOFAIL behavior without any allocation fallback strategy. Let's
+remove the open coded loop and replace it with __GFP_NOFAIL. Without the
+flag the allocator has no way to find out never-fail requirement and
+cannot help in any way.
+
+Signed-off-by: Michal Hocko <mhocko@suse.cz>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/mballoc.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -4800,18 +4800,12 @@ do_more:
+ /*
+ * blocks being freed are metadata. these blocks shouldn't
+ * be used until this transaction is committed
++ *
++ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
++ * to fail.
+ */
+- retry:
+- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
+- if (!new_entry) {
+- /*
+- * We use a retry loop because
+- * ext4_free_blocks() is not allowed to fail.
+- */
+- cond_resched();
+- congestion_wait(BLK_RW_ASYNC, HZ/50);
+- goto retry;
+- }
++ new_entry = kmem_cache_alloc(ext4_free_data_cachep,
++ GFP_NOFS|__GFP_NOFAIL);
+ new_entry->efd_start_cluster = bit;
+ new_entry->efd_group = block_group;
+ new_entry->efd_count = count_clusters;
--- /dev/null
+From a2fd66d069d86d793e9d39d4079b96f46d13f237 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Tue, 23 Jun 2015 11:03:54 -0400
+Subject: ext4: set lazytime on remount if MS_LAZYTIME is set by mount
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit a2fd66d069d86d793e9d39d4079b96f46d13f237 upstream.
+
+Newer versions of mount parse the lazytime feature and pass it to the
+mount system call via the flags field in the mount system call,
+removing the lazytime string from the mount options list. So we need
+to check for the presence of MS_LAZYTIME and set it in sb->s_flags in
+order for this flag to be set on a remount.
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/super.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -4944,6 +4944,9 @@ static int ext4_remount(struct super_blo
+ set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
+ }
+
++ if (*flags & MS_LAZYTIME)
++ sb->s_flags |= MS_LAZYTIME;
++
+ if ((*flags & MS_RDONLY) != (sb->s_flags & MS_RDONLY)) {
+ if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) {
+ err = -EROFS;
--- /dev/null
+From 1e25aa9641e8f3fa39cd5e46b4afcafd7f12a44b Mon Sep 17 00:00:00 2001
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Date: Mon, 1 Jun 2015 16:36:27 -0700
+Subject: hid-sensor: Fix suspend/resume delay
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+commit 1e25aa9641e8f3fa39cd5e46b4afcafd7f12a44b upstream.
+
+By default all the sensors are runtime suspended state (lowest power
+state). During Linux suspend process, all the run time suspended
+devices are resumed and then suspended. This caused all sensors to
+power up and introduced delay in suspend time, when we introduced
+runtime PM for HID sensors. The opposite process happens during resume
+process.
+
+To fix this, we do powerup process of the sensors only when the request
+is issued from user (raw or tiggerred). In this way when runtime,
+resume calls for powerup it will simply return as this will not match
+user requested state.
+
+Note this is a regression fix as the increase in suspend / resume
+times can be substantial (report of 8 seconds on Len's laptop!)
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Tested-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 11 ++++++++++-
+ include/linux/hid-sensor-hub.h | 1 +
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+@@ -36,6 +36,8 @@ static int _hid_sensor_power_state(struc
+ s32 poll_value = 0;
+
+ if (state) {
++ if (!atomic_read(&st->user_requested_state))
++ return 0;
+ if (sensor_hub_device_open(st->hsdev))
+ return -EIO;
+
+@@ -52,8 +54,12 @@ static int _hid_sensor_power_state(struc
+
+ poll_value = hid_sensor_read_poll_value(st);
+ } else {
+- if (!atomic_dec_and_test(&st->data_ready))
++ int val;
++
++ val = atomic_dec_if_positive(&st->data_ready);
++ if (val < 0)
+ return 0;
++
+ sensor_hub_device_close(st->hsdev);
+ state_val = hid_sensor_get_usage_index(st->hsdev,
+ st->power_state.report_id,
+@@ -92,9 +98,11 @@ EXPORT_SYMBOL(hid_sensor_power_state);
+
+ int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
+ {
++
+ #ifdef CONFIG_PM
+ int ret;
+
++ atomic_set(&st->user_requested_state, state);
+ if (state)
+ ret = pm_runtime_get_sync(&st->pdev->dev);
+ else {
+@@ -109,6 +117,7 @@ int hid_sensor_power_state(struct hid_se
+
+ return 0;
+ #else
++ atomic_set(&st->user_requested_state, state);
+ return _hid_sensor_power_state(st, state);
+ #endif
+ }
+--- a/include/linux/hid-sensor-hub.h
++++ b/include/linux/hid-sensor-hub.h
+@@ -230,6 +230,7 @@ struct hid_sensor_common {
+ struct platform_device *pdev;
+ unsigned usage_id;
+ atomic_t data_ready;
++ atomic_t user_requested_state;
+ struct iio_trigger *trigger;
+ struct hid_sensor_hub_attribute_info poll;
+ struct hid_sensor_hub_attribute_info report_state;
--- /dev/null
+From 93563a6a71bb69dd324fc7354c60fb05f84aae6b Mon Sep 17 00:00:00 2001
+From: Cyrille Pitchen <cyrille.pitchen@atmel.com>
+Date: Tue, 9 Jun 2015 18:22:14 +0200
+Subject: i2c: at91: fix a race condition when using the DMA controller
+
+From: Cyrille Pitchen <cyrille.pitchen@atmel.com>
+
+commit 93563a6a71bb69dd324fc7354c60fb05f84aae6b upstream.
+
+For TX transactions, the TXCOMP bit in the Status Register is cleared
+when the first data is written into the Transmit Holding Register.
+
+In the lines from at91_do_twi_transfer():
+at91_twi_write_data_dma(dev);
+at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
+
+the TXCOMP interrupt may be enabled before the DMA controller has
+actually started to write into the THR. In such a case, the TXCOMP bit
+is still set into the Status Register so the interrupt is triggered
+immediately. The driver understands that a transaction completion has
+occurred but this transaction hasn't started yet. Hence the TXCOMP
+interrupt is no longer enabled by at91_do_twi_transfer() but instead
+by at91_twi_write_data_dma_callback().
+
+Also, the TXCOMP bit in the Status Register in not a clear on read flag
+but a snapshot of the transmission state at the time the Status
+Register is read.
+When a NACK error is dectected by the I2C controller, the TXCOMP, NACK
+and TXRDY bits are set together to 1 in the SR. If enabled, the TXCOMP
+interrupt is triggered at the same time. Also setting the TXRDY to 1
+triggers the DMA controller to write the next data into the THR. Such
+a write resets the TXCOMP bit to 0 in the SR. So depending on when the
+interrupt handler reads the SR, it may fail to detect the NACK error
+if it relies on the TXCOMP bit. The NACK bit and its interrupt should
+be used instead.
+
+For RX transactions, the TXCOMP bit in the Status Register is cleared
+when the START bit is set into the Control Register. However to unify
+the management of the TXCOMP bit when the DMA controller is used, the
+TXCOMP interrupt is now enabled by the DMA callbacks for both TX and
+RX transfers.
+
+Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-at91.c | 70 +++++++++++++++++++++++++++++++-----------
+ 1 file changed, 53 insertions(+), 17 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-at91.c
++++ b/drivers/i2c/busses/i2c-at91.c
+@@ -65,6 +65,9 @@
+ #define AT91_TWI_UNRE 0x0080 /* Underrun Error */
+ #define AT91_TWI_NACK 0x0100 /* Not Acknowledged */
+
++#define AT91_TWI_INT_MASK \
++ (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK)
++
+ #define AT91_TWI_IER 0x0024 /* Interrupt Enable Register */
+ #define AT91_TWI_IDR 0x0028 /* Interrupt Disable Register */
+ #define AT91_TWI_IMR 0x002c /* Interrupt Mask Register */
+@@ -119,13 +122,12 @@ static void at91_twi_write(struct at91_t
+
+ static void at91_disable_twi_interrupts(struct at91_twi_dev *dev)
+ {
+- at91_twi_write(dev, AT91_TWI_IDR,
+- AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY);
++ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK);
+ }
+
+ static void at91_twi_irq_save(struct at91_twi_dev *dev)
+ {
+- dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7;
++ dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK;
+ at91_disable_twi_interrupts(dev);
+ }
+
+@@ -215,6 +217,14 @@ static void at91_twi_write_data_dma_call
+ dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg),
+ dev->buf_len, DMA_TO_DEVICE);
+
++ /*
++ * When this callback is called, THR/TX FIFO is likely not to be empty
++ * yet. So we have to wait for TXCOMP or NACK bits to be set into the
++ * Status Register to be sure that the STOP bit has been sent and the
++ * transfer is completed. The NACK interrupt has already been enabled,
++ * we just have to enable TXCOMP one.
++ */
++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
+ at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
+ }
+
+@@ -309,7 +319,7 @@ static void at91_twi_read_data_dma_callb
+ /* The last two bytes have to be read without using dma */
+ dev->buf += dev->buf_len - 2;
+ dev->buf_len = 2;
+- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY);
++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP);
+ }
+
+ static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
+@@ -370,7 +380,7 @@ static irqreturn_t atmel_twi_interrupt(i
+ /* catch error flags */
+ dev->transfer_status |= status;
+
+- if (irqstatus & AT91_TWI_TXCOMP) {
++ if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) {
+ at91_disable_twi_interrupts(dev);
+ complete(&dev->cmd_complete);
+ }
+@@ -384,6 +394,34 @@ static int at91_do_twi_transfer(struct a
+ unsigned long time_left;
+ bool has_unre_flag = dev->pdata->has_unre_flag;
+
++ /*
++ * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
++ * read flag but shows the state of the transmission at the time the
++ * Status Register is read. According to the programmer datasheet,
++ * TXCOMP is set when both holding register and internal shifter are
++ * empty and STOP condition has been sent.
++ * Consequently, we should enable NACK interrupt rather than TXCOMP to
++ * detect transmission failure.
++ *
++ * Besides, the TXCOMP bit is already set before the i2c transaction
++ * has been started. For read transactions, this bit is cleared when
++ * writing the START bit into the Control Register. So the
++ * corresponding interrupt can safely be enabled just after.
++ * However for write transactions managed by the CPU, we first write
++ * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP
++ * interrupt. If TXCOMP interrupt were enabled before writing into THR,
++ * the interrupt handler would be called immediately and the i2c command
++ * would be reported as completed.
++ * Also when a write transaction is managed by the DMA controller,
++ * enabling the TXCOMP interrupt in this function may lead to a race
++ * condition since we don't know whether the TXCOMP interrupt is enabled
++ * before or after the DMA has started to write into THR. So the TXCOMP
++ * interrupt is enabled later by at91_twi_write_data_dma_callback().
++ * Immediately after in that DMA callback, we still need to send the
++ * STOP condition manually writing the corresponding bit into the
++ * Control Register.
++ */
++
+ dev_dbg(dev->dev, "transfer: %s %d bytes.\n",
+ (dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len);
+
+@@ -414,26 +452,24 @@ static int at91_do_twi_transfer(struct a
+ * seems to be the best solution.
+ */
+ if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
+ at91_twi_read_data_dma(dev);
+- /*
+- * It is important to enable TXCOMP irq here because
+- * doing it only when transferring the last two bytes
+- * will mask NACK errors since TXCOMP is set when a
+- * NACK occurs.
+- */
+- at91_twi_write(dev, AT91_TWI_IER,
+- AT91_TWI_TXCOMP);
+- } else
++ } else {
+ at91_twi_write(dev, AT91_TWI_IER,
+- AT91_TWI_TXCOMP | AT91_TWI_RXRDY);
++ AT91_TWI_TXCOMP |
++ AT91_TWI_NACK |
++ AT91_TWI_RXRDY);
++ }
+ } else {
+ if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
++ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
+ at91_twi_write_data_dma(dev);
+- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
+ } else {
+ at91_twi_write_next_byte(dev);
+ at91_twi_write(dev, AT91_TWI_IER,
+- AT91_TWI_TXCOMP | AT91_TWI_TXRDY);
++ AT91_TWI_TXCOMP |
++ AT91_TWI_NACK |
++ AT91_TWI_TXRDY);
+ }
+ }
+
--- /dev/null
+From 0a8237ae319ab5988d40a7a9b33d68846aae34b4 Mon Sep 17 00:00:00 2001
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Date: Fri, 12 Jun 2015 14:41:00 +0200
+Subject: i2c: mux: pca954x: Use __i2c_transfer because of quirks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+
+commit 0a8237ae319ab5988d40a7a9b33d68846aae34b4 upstream.
+
+pca9541 and pca954x are calling master_xfer() of the parent adapter directly
+thus bypassing the quirks checks of the adapter. Use __i2c_transfer() instead.
+
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Tested-by: Łukasz Gemborowski <lukasz.gemborowski@nokia.com>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Jisheng Zhang <jszhang@marvell.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: b7f625840267b1 ("i2c: add quirk checks to core")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/muxes/i2c-mux-pca9541.c | 4 ++--
+ drivers/i2c/muxes/i2c-mux-pca954x.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/muxes/i2c-mux-pca9541.c
++++ b/drivers/i2c/muxes/i2c-mux-pca9541.c
+@@ -104,7 +104,7 @@ static int pca9541_reg_write(struct i2c_
+ buf[0] = command;
+ buf[1] = val;
+ msg.buf = buf;
+- ret = adap->algo->master_xfer(adap, &msg, 1);
++ ret = __i2c_transfer(adap, &msg, 1);
+ } else {
+ union i2c_smbus_data data;
+
+@@ -144,7 +144,7 @@ static int pca9541_reg_read(struct i2c_c
+ .buf = &val
+ }
+ };
+- ret = adap->algo->master_xfer(adap, msg, 2);
++ ret = __i2c_transfer(adap, msg, 2);
+ if (ret == 2)
+ ret = val;
+ else if (ret >= 0)
+--- a/drivers/i2c/muxes/i2c-mux-pca954x.c
++++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
+@@ -134,7 +134,7 @@ static int pca954x_reg_write(struct i2c_
+ msg.len = 1;
+ buf[0] = val;
+ msg.buf = buf;
+- ret = adap->algo->master_xfer(adap, &msg, 1);
++ ret = __i2c_transfer(adap, &msg, 1);
+ } else {
+ union i2c_smbus_data data;
+ ret = adap->algo->smbus_xfer(adap, client->addr,
--- /dev/null
+From e766f338a74200b8104b1165776b19f56e252834 Mon Sep 17 00:00:00 2001
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Date: Fri, 12 Jun 2015 14:40:37 +0200
+Subject: i2c: mux: Use __i2c_transfer() instead of calling parent's master_xfer()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+
+commit e766f338a74200b8104b1165776b19f56e252834 upstream.
+
+Newly introduced quirks infrastructure doesn't work for the devices behind
+MUXes because MUX's master_xfer() calls parent's master_xfer() directly
+without checking the quirks. Instead of duplicating check code in MUX just
+call __i2c_transfer() instead. This has a side effect on tracing (messages
+will appear on both MUX bus and parent bus), but maybe that's not bad at
+the end.
+
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Tested-by: Łukasz Gemborowski <lukasz.gemborowski@nokia.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: b7f625840267b1 ("i2c: add quirk checks to core")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/i2c-mux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/i2c-mux.c
++++ b/drivers/i2c/i2c-mux.c
+@@ -51,7 +51,7 @@ static int i2c_mux_master_xfer(struct i2
+
+ ret = priv->select(parent, priv->mux_priv, priv->chan_id);
+ if (ret >= 0)
+- ret = parent->algo->master_xfer(parent, msgs, num);
++ ret = __i2c_transfer(parent, msgs, num);
+ if (priv->deselect)
+ priv->deselect(parent, priv->mux_priv, priv->chan_id);
+
--- /dev/null
+From dc362d50ba94eaf2b1f11eecd81eb1d040d2d6e6 Mon Sep 17 00:00:00 2001
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Date: Fri, 12 Jun 2015 14:41:16 +0200
+Subject: i2c: use parent adapter quirks in mux
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+
+commit dc362d50ba94eaf2b1f11eecd81eb1d040d2d6e6 upstream.
+
+Inherit parent adapter quirks in MUX in case the devices on the multiplexed
+buses are interested in the adapter limitations.
+
+Signed-off-by: Łukasz Gemborowski <lukasz.gemborowski@nokia.com>
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Fixes: b7f625840267b1 ("i2c: add quirk checks to core")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/i2c-mux.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/i2c/i2c-mux.c
++++ b/drivers/i2c/i2c-mux.c
+@@ -144,6 +144,7 @@ struct i2c_adapter *i2c_add_mux_adapter(
+ priv->adap.dev.parent = &parent->dev;
+ priv->adap.retries = parent->retries;
+ priv->adap.timeout = parent->timeout;
++ priv->adap.quirks = parent->quirks;
+
+ /* Sanity check on class */
+ if (i2c_mux_parent_classes(parent) & class)
--- /dev/null
+From 8a70cefa3037d62e7c0b6068a66675def1a330c9 Mon Sep 17 00:00:00 2001
+From: Lennert Buytenhek <buytenh@wantstofly.org>
+Date: Wed, 3 Jun 2015 10:50:19 +0300
+Subject: ieee802154: Fix sockaddr_ieee802154 implicit padding information leak.
+
+From: Lennert Buytenhek <buytenh@wantstofly.org>
+
+commit 8a70cefa3037d62e7c0b6068a66675def1a330c9 upstream.
+
+The AF_IEEE802154 sockaddr looks like this:
+
+ struct sockaddr_ieee802154 {
+ sa_family_t family; /* AF_IEEE802154 */
+ struct ieee802154_addr_sa addr;
+ };
+
+ struct ieee802154_addr_sa {
+ int addr_type;
+ u16 pan_id;
+ union {
+ u8 hwaddr[IEEE802154_ADDR_LEN];
+ u16 short_addr;
+ };
+ };
+
+On most architectures there will be implicit structure padding here,
+in two different places:
+
+* In struct sockaddr_ieee802154, two bytes of padding between 'family'
+ (unsigned short) and 'addr', so that 'addr' starts on a four byte
+ boundary.
+
+* In struct ieee802154_addr_sa, two bytes at the end of the structure,
+ to make the structure 16 bytes.
+
+When calling recvmsg(2) on a PF_IEEE802154 SOCK_DGRAM socket, the
+ieee802154 stack constructs a struct sockaddr_ieee802154 on the
+kernel stack without clearing these padding fields, and, depending
+on the addr_type, between four and ten bytes of uncleared kernel
+stack will be copied to userspace.
+
+We can't just insert two 'u16 __pad's in the right places and zero
+those before copying an address to userspace, as not all architectures
+insert this implicit padding -- from a quick test it seems that avr32,
+cris and m68k don't insert this padding, while every other architecture
+that I have cross compilers for does insert this padding.
+
+The easiest way to plug the leak is to just memset the whole struct
+sockaddr_ieee802154 before filling in the fields we want to fill in,
+and that's what this patch does.
+
+Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
+Acked-by: Alexander Aring <alex.aring@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ieee802154/socket.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/ieee802154/socket.c
++++ b/net/ieee802154/socket.c
+@@ -739,6 +739,12 @@ static int dgram_recvmsg(struct sock *sk
+ sock_recv_ts_and_drops(msg, sk, skb);
+
+ if (saddr) {
++ /* Clear the implicit padding in struct sockaddr_ieee802154
++ * (16 bits between 'family' and 'addr') and in struct
++ * ieee802154_addr_sa (16 bits at the end of the structure).
++ */
++ memset(saddr, 0, sizeof(*saddr));
++
+ saddr->family = AF_IEEE802154;
+ ieee802154_addr_to_sa(&saddr->addr, &mac_cb(skb)->source);
+ *addr_len = sizeof(*saddr);
--- /dev/null
+From bdc10d57f236b534fb675a4bbefd10017aeb2b26 Mon Sep 17 00:00:00 2001
+From: Daniel Baluta <daniel.baluta@intel.com>
+Date: Thu, 11 Jun 2015 18:49:33 +0300
+Subject: iio: ABI: Clarify proximity output value
+
+From: Daniel Baluta <daniel.baluta@intel.com>
+
+commit bdc10d57f236b534fb675a4bbefd10017aeb2b26 upstream.
+
+Current description for proximity measurement is ambiguous. While
+the first part says that proximity is measured by observing
+reflectivity, the second part incorrectly infers that reported values
+should behave like a distance.
+
+This is because of AS3935 lightning sensor which uses the proximity
+API, while not being a true proximity sensor.
+
+Note this is marked for stable as it accompanies a fix in ABI usage
+to the sx9500 driver which would otherwise appear to be correct.
+
+Fixes: 614e8842ddf ("iio: ABI: add clarification for proximity")
+Signed-off-by: Daniel Baluta <daniel.baluta@intel.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/ABI/testing/sysfs-bus-iio | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/Documentation/ABI/testing/sysfs-bus-iio
++++ b/Documentation/ABI/testing/sysfs-bus-iio
+@@ -1165,10 +1165,8 @@ Description:
+ object is near the sensor, usually be observing
+ reflectivity of infrared or ultrasound emitted.
+ Often these sensors are unit less and as such conversion
+- to SI units is not possible. Where it is, the units should
+- be meters. If such a conversion is not possible, the reported
+- values should behave in the same way as a distance, i.e. lower
+- values indicate something is closer to the sensor.
++ to SI units is not possible. Higher proximity measurements
++ indicate closer objects, and vice versa.
+
+ What: /sys/.../iio:deviceX/in_illuminance_input
+ What: /sys/.../iio:deviceX/in_illuminance_raw
--- /dev/null
+From 7a1d0d91c94305fa5802a53df3a54c0ea1963c48 Mon Sep 17 00:00:00 2001
+From: Hartmut Knaack <knaack.h@gmx.de>
+Date: Mon, 15 Jun 2015 23:48:24 +0200
+Subject: iio:accel:bmc150-accel: fix counting direction
+
+From: Hartmut Knaack <knaack.h@gmx.de>
+
+commit 7a1d0d91c94305fa5802a53df3a54c0ea1963c48 upstream.
+
+In bmc150_accel_unregister_triggers() triggers should be unregistered in
+reverse order of registration. Trigger registration starts with number 0,
+counting up. In consequence, trigger number needs to be count down here.
+
+Signed-off-by: Hartmut Knaack <knaack.h@gmx.de>
+Reviewed-by: Octavian Purdila <octavian.purdila@intel.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/bmc150-accel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/accel/bmc150-accel.c
++++ b/drivers/iio/accel/bmc150-accel.c
+@@ -1465,7 +1465,7 @@ static void bmc150_accel_unregister_trig
+ {
+ int i;
+
+- for (i = from; i >= 0; i++) {
++ for (i = from; i >= 0; i--) {
+ if (data->triggers[i].indio_trig) {
+ iio_trigger_unregister(data->triggers[i].indio_trig);
+ data->triggers[i].indio_trig = NULL;
--- /dev/null
+From 2ab5f39bc7825808e0fa1e7e5f0b23e174563467 Mon Sep 17 00:00:00 2001
+From: Jan Leupold <leupold@rsi-elektrotechnik.de>
+Date: Wed, 17 Jun 2015 18:21:36 +0200
+Subject: iio: adc: at91_adc: allow to use full range of startup time
+
+From: Jan Leupold <leupold@rsi-elektrotechnik.de>
+
+commit 2ab5f39bc7825808e0fa1e7e5f0b23e174563467 upstream.
+
+The DT-Property "atmel,adc-startup-time" is stored in an u8 for a microsecond
+value. When trying to increase the value of STARTUP in Register AT91_ADC_MR
+some higher values can't be reached.
+
+Change the type in function parameter and private structure field from u8 to
+u32.
+
+Signed-off-by: Jan Leupold <leupold@rsi-elektrotechnik.de>
+[nicolas.ferre@atmel.com: change commit message, increase u16 to u32 for startup time]
+Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/at91_adc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -182,7 +182,7 @@ struct at91_adc_caps {
+ u8 ts_pen_detect_sensitivity;
+
+ /* startup time calculate function */
+- u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz);
++ u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz);
+
+ u8 num_channels;
+ struct at91_adc_reg_desc registers;
+@@ -201,7 +201,7 @@ struct at91_adc_state {
+ u8 num_channels;
+ void __iomem *reg_base;
+ struct at91_adc_reg_desc *registers;
+- u8 startup_time;
++ u32 startup_time;
+ u8 sample_hold_time;
+ bool sleep_mode;
+ struct iio_trigger **trig;
+@@ -779,7 +779,7 @@ ret:
+ return ret;
+ }
+
+-static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
++static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz)
+ {
+ /*
+ * Number of ticks needed to cover the startup time of the ADC
+@@ -790,7 +790,7 @@ static u32 calc_startup_ticks_9260(u8 st
+ return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8;
+ }
+
+-static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz)
++static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz)
+ {
+ /*
+ * For sama5d3x and at91sam9x5, the formula changes to:
--- /dev/null
+From b2b3c3dc6a7bef886850920f5f5dca041b443aa0 Mon Sep 17 00:00:00 2001
+From: Hartmut Knaack <knaack.h@gmx.de>
+Date: Sun, 21 Jun 2015 12:15:50 +0200
+Subject: iio:adc:cc10001_adc: fix Kconfig dependency
+
+From: Hartmut Knaack <knaack.h@gmx.de>
+
+commit b2b3c3dc6a7bef886850920f5f5dca041b443aa0 upstream.
+
+The Cosmic Circuits 10001 ADC driver depends on HAS_IOMEM, HAVE_CLK and
+REGULATOR together, not just any of these.
+
+Signed-off-by: Hartmut Knaack <knaack.h@gmx.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/Kconfig | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/iio/adc/Kconfig
++++ b/drivers/iio/adc/Kconfig
+@@ -146,8 +146,7 @@ config DA9150_GPADC
+
+ config CC10001_ADC
+ tristate "Cosmic Circuits 10001 ADC driver"
+- depends on HAVE_CLK || REGULATOR
+- depends on HAS_IOMEM
++ depends on HAS_IOMEM && HAVE_CLK && REGULATOR
+ select IIO_BUFFER
+ select IIO_TRIGGERED_BUFFER
+ help
--- /dev/null
+From dc7b8d98ac003c9f1e83a5f927c372dac6f114a1 Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko@sntech.de>
+Date: Mon, 25 May 2015 22:36:58 +0200
+Subject: iio: adc: rockchip_saradc: add missing MODULE_* data
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+commit dc7b8d98ac003c9f1e83a5f927c372dac6f114a1 upstream.
+
+The module-data is currently missing. This includes the license-information
+which makes the driver taint the kernel and miss symbols when compiled as
+module.
+
+Fixes: 44d6f2ef94f9 ("iio: adc: add driver for Rockchip saradc")
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/rockchip_saradc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/iio/adc/rockchip_saradc.c
++++ b/drivers/iio/adc/rockchip_saradc.c
+@@ -349,3 +349,7 @@ static struct platform_driver rockchip_s
+ };
+
+ module_platform_driver(rockchip_saradc_driver);
++
++MODULE_AUTHOR("Heiko Stuebner <heiko@sntech.de>");
++MODULE_DESCRIPTION("Rockchip SARADC driver");
++MODULE_LICENSE("GPL v2");
--- /dev/null
+From adfa969850ae93beca57f7527f0e4dc10cbe1309 Mon Sep 17 00:00:00 2001
+From: JM Friedt <jmfriedt@femto-st.fr>
+Date: Fri, 19 Jun 2015 14:48:06 +0200
+Subject: iio: DAC: ad5624r_spi: fix bit shift of output data value
+
+From: JM Friedt <jmfriedt@femto-st.fr>
+
+commit adfa969850ae93beca57f7527f0e4dc10cbe1309 upstream.
+
+The value sent on the SPI bus is shifted by an erroneous number of bits.
+The shift value was already computed in the iio_chan_spec structure and
+hence subtracting this argument to 16 yields an erroneous data position
+in the SPI stream.
+
+Signed-off-by: JM Friedt <jmfriedt@femto-st.fr>
+Acked-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/dac/ad5624r_spi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/dac/ad5624r_spi.c
++++ b/drivers/iio/dac/ad5624r_spi.c
+@@ -22,7 +22,7 @@
+ #include "ad5624r.h"
+
+ static int ad5624r_spi_write(struct spi_device *spi,
+- u8 cmd, u8 addr, u16 val, u8 len)
++ u8 cmd, u8 addr, u16 val, u8 shift)
+ {
+ u32 data;
+ u8 msg[3];
+@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_
+ * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
+ * for the AD5664R, AD5644R, and AD5624R, respectively.
+ */
+- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
++ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
+ msg[0] = data >> 16;
+ msg[1] = data >> 8;
+ msg[2] = data;
--- /dev/null
+From 6a3c45bb5a385be7049a7725a4fe93eaa76915f4 Mon Sep 17 00:00:00 2001
+From: Adriana Reus <adriana.reus@intel.com>
+Date: Fri, 12 Jun 2015 18:10:23 +0300
+Subject: iio: inv-mpu: Specify the expected format/precision for write channels
+
+From: Adriana Reus <adriana.reus@intel.com>
+
+commit 6a3c45bb5a385be7049a7725a4fe93eaa76915f4 upstream.
+
+The gyroscope needs IIO_VAL_INT_PLUS_NANO for the scale channel and
+unless specified write returns MICRO by default.
+This needs to be properly specified so that write operations into scale
+have the expected behaviour.
+
+Signed-off-by: Adriana Reus <adriana.reus@intel.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+@@ -431,6 +431,23 @@ static int inv_mpu6050_write_gyro_scale(
+ return -EINVAL;
+ }
+
++static int inv_write_raw_get_fmt(struct iio_dev *indio_dev,
++ struct iio_chan_spec const *chan, long mask)
++{
++ switch (mask) {
++ case IIO_CHAN_INFO_SCALE:
++ switch (chan->type) {
++ case IIO_ANGL_VEL:
++ return IIO_VAL_INT_PLUS_NANO;
++ default:
++ return IIO_VAL_INT_PLUS_MICRO;
++ }
++ default:
++ return IIO_VAL_INT_PLUS_MICRO;
++ }
++
++ return -EINVAL;
++}
+ static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val)
+ {
+ int result, i;
+@@ -696,6 +713,7 @@ static const struct iio_info mpu_info =
+ .driver_module = THIS_MODULE,
+ .read_raw = &inv_mpu6050_read_raw,
+ .write_raw = &inv_mpu6050_write_raw,
++ .write_raw_get_fmt = &inv_write_raw_get_fmt,
+ .attrs = &inv_attribute_group,
+ .validate_trigger = inv_mpu6050_validate_trigger,
+ };
--- /dev/null
+From c288503b32e8c5534062a05ec565d28bffa06db3 Mon Sep 17 00:00:00 2001
+From: Hartmut Knaack <knaack.h@gmx.de>
+Date: Thu, 18 Jun 2015 00:31:59 +0200
+Subject: iio:light:cm3323: clear bitmask before set
+
+From: Hartmut Knaack <knaack.h@gmx.de>
+
+commit c288503b32e8c5534062a05ec565d28bffa06db3 upstream.
+
+When setting the bits for integration time, the appropriate bitmask needs
+to be cleared first.
+
+Signed-off-by: Hartmut Knaack <knaack.h@gmx.de>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/light/cm3323.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/light/cm3323.c
++++ b/drivers/iio/light/cm3323.c
+@@ -123,7 +123,7 @@ static int cm3323_set_it_bits(struct cm3
+ for (i = 0; i < ARRAY_SIZE(cm3323_int_time); i++) {
+ if (val == cm3323_int_time[i].val &&
+ val2 == cm3323_int_time[i].val2) {
+- reg_conf = data->reg_conf;
++ reg_conf = data->reg_conf & ~CM3323_CONF_IT_MASK;
+ reg_conf |= i << CM3323_CONF_IT_SHIFT;
+
+ ret = i2c_smbus_write_word_data(data->client,
--- /dev/null
+From 33361e5678a541f82f29f85467d589e7bf8da76b Mon Sep 17 00:00:00 2001
+From: Peter Meerwald <pmeerw@pmeerw.net>
+Date: Sun, 14 Jun 2015 23:09:35 +0200
+Subject: iio: light: tcs3414: Fix bug preventing to set integration time
+
+From: Peter Meerwald <pmeerw@pmeerw.net>
+
+commit 33361e5678a541f82f29f85467d589e7bf8da76b upstream.
+
+the millisecond values in tcs3414_times should be checked against
+val2, not val, which is always zero.
+
+Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net>
+Reported-by: Stephan Kleisinger <stephan.kleisinger@gmail.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/light/tcs3414.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/light/tcs3414.c
++++ b/drivers/iio/light/tcs3414.c
+@@ -185,7 +185,7 @@ static int tcs3414_write_raw(struct iio_
+ if (val != 0)
+ return -EINVAL;
+ for (i = 0; i < ARRAY_SIZE(tcs3414_times); i++) {
+- if (val == tcs3414_times[i] * 1000) {
++ if (val2 == tcs3414_times[i] * 1000) {
+ data->timing &= ~TCS3414_INTEG_MASK;
+ data->timing |= i;
+ return i2c_smbus_write_byte_data(
--- /dev/null
+From fd1883f07cb434707e50c4c9a16e3ed4b3a5e74f Mon Sep 17 00:00:00 2001
+From: Daniel Baluta <daniel.baluta@intel.com>
+Date: Thu, 11 Jun 2015 18:49:34 +0300
+Subject: iio: proximity: sx9500: Fix proximity value
+
+From: Daniel Baluta <daniel.baluta@intel.com>
+
+commit fd1883f07cb434707e50c4c9a16e3ed4b3a5e74f upstream.
+
+Because of the ABI confusion proximity value exposed by SX9500
+was inverted.
+
+Signed-off-by: Daniel Baluta <daniel.baluta@intel.com>
+Reviewed-by: Vlad Dogaru <vlad.dogaru@intel.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/proximity/sx9500.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/proximity/sx9500.c
++++ b/drivers/iio/proximity/sx9500.c
+@@ -206,7 +206,7 @@ static int sx9500_read_proximity(struct
+ if (ret < 0)
+ return ret;
+
+- *val = 32767 - (s16)be16_to_cpu(regval);
++ *val = be16_to_cpu(regval);
+
+ return IIO_VAL_INT;
+ }
--- /dev/null
+From 8d05abfaeff52bdf66aba3a3a337dcdbdb4911bf Mon Sep 17 00:00:00 2001
+From: Peter Meerwald <pmeerw@pmeerw.net>
+Date: Sun, 21 Jun 2015 23:50:21 +0200
+Subject: iio: tmp006: Check channel info on write
+
+From: Peter Meerwald <pmeerw@pmeerw.net>
+
+commit 8d05abfaeff52bdf66aba3a3a337dcdbdb4911bf upstream.
+
+only SAMP_FREQ is writable
+
+Will lead to SAMP_FREQ being written by any attempt to write
+to the other exported attributes and hence a rather unexpected
+result!
+
+Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/temperature/tmp006.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/iio/temperature/tmp006.c
++++ b/drivers/iio/temperature/tmp006.c
+@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_d
+ struct tmp006_data *data = iio_priv(indio_dev);
+ int i;
+
++ if (mask != IIO_CHAN_INFO_SAMP_FREQ)
++ return -EINVAL;
++
+ for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++)
+ if ((val == tmp006_freqs[i][0]) &&
+ (val2 == tmp006_freqs[i][1])) {
--- /dev/null
+From 6c0d48cb29c29b306ba3548afb45154d22eb4d78 Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <fabio.estevam@freescale.com>
+Date: Sun, 24 May 2015 17:39:04 -0300
+Subject: iio: twl4030-madc: Pass the IRQF_ONESHOT flag
+
+From: Fabio Estevam <fabio.estevam@freescale.com>
+
+commit 6c0d48cb29c29b306ba3548afb45154d22eb4d78 upstream.
+
+Since commit 1c6c69525b40 ("genirq: Reject bogus threaded irq requests")
+threaded IRQs without a primary handler need to be requested with
+IRQF_ONESHOT, otherwise the request will fail.
+
+So pass the IRQF_ONESHOT flag in this case.
+
+The semantic patch that makes this change is available
+in scripts/coccinelle/misc/irqf_oneshot.cocci.
+
+Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
+Signed-off-by: Jonathan Cameron <jic23@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/twl4030-madc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/iio/adc/twl4030-madc.c
++++ b/drivers/iio/adc/twl4030-madc.c
+@@ -835,7 +835,8 @@ static int twl4030_madc_probe(struct pla
+ irq = platform_get_irq(pdev, 0);
+ ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
+ twl4030_madc_threaded_irq_handler,
+- IRQF_TRIGGER_RISING, "twl4030_madc", madc);
++ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
++ "twl4030_madc", madc);
+ if (ret) {
+ dev_err(&pdev->dev, "could not request irq\n");
+ goto err_i2c;
--- /dev/null
+From 6f6a6fda294506dfe0e3e0a253bb2d2923f28f0a Mon Sep 17 00:00:00 2001
+From: Joseph Qi <joseph.qi@huawei.com>
+Date: Mon, 15 Jun 2015 14:36:01 -0400
+Subject: jbd2: fix ocfs2 corrupt when updating journal superblock fails
+
+From: Joseph Qi <joseph.qi@huawei.com>
+
+commit 6f6a6fda294506dfe0e3e0a253bb2d2923f28f0a upstream.
+
+If updating journal superblock fails after journal data has been
+flushed, the error is omitted and this will mislead the caller as a
+normal case. In ocfs2, the checkpoint will be treated successfully
+and the other node can get the lock to update. Since the sb_start is
+still pointing to the old log block, it will rewrite the journal data
+during journal recovery by the other node. Thus the new updates will
+be overwritten and ocfs2 corrupts. So in above case we have to return
+the error, and ocfs2_commit_cache will take care of the error and
+prevent the other node to do update first. And only after recovering
+journal it can do the new updates.
+
+The issue discussion mail can be found at:
+https://oss.oracle.com/pipermail/ocfs2-devel/2015-June/010856.html
+http://comments.gmane.org/gmane.comp.file-systems.ext4/48841
+
+[ Fixed bug in patch which allowed a non-negative error return from
+ jbd2_cleanup_journal_tail() to leak out of jbd2_fjournal_flush(); this
+ was causing xfstests ext4/306 to fail. -- Ted ]
+
+Reported-by: Yiwen Jiang <jiangyiwen@huawei.com>
+Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Tested-by: Yiwen Jiang <jiangyiwen@huawei.com>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/checkpoint.c | 5 ++---
+ fs/jbd2/journal.c | 38 +++++++++++++++++++++++++++++++-------
+ include/linux/jbd2.h | 4 ++--
+ 3 files changed, 35 insertions(+), 12 deletions(-)
+
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -390,7 +390,7 @@ int jbd2_cleanup_journal_tail(journal_t
+ unsigned long blocknr;
+
+ if (is_journal_aborted(journal))
+- return 1;
++ return -EIO;
+
+ if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
+ return 1;
+@@ -407,8 +407,7 @@ int jbd2_cleanup_journal_tail(journal_t
+ if (journal->j_flags & JBD2_BARRIER)
+ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
+
+- __jbd2_update_log_tail(journal, first_tid, blocknr);
+- return 0;
++ return __jbd2_update_log_tail(journal, first_tid, blocknr);
+ }
+
+
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t
+ *
+ * Requires j_checkpoint_mutex
+ */
+-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
+ {
+ unsigned long freed;
++ int ret;
+
+ BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
+
+@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *j
+ * space and if we lose sb update during power failure we'd replay
+ * old transaction with possibly newly overwritten data.
+ */
+- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
++ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
++ if (ret)
++ goto out;
++
+ write_lock(&journal->j_state_lock);
+ freed = block - journal->j_tail;
+ if (block < journal->j_tail)
+@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *j
+ journal->j_tail_sequence = tid;
+ journal->j_tail = block;
+ write_unlock(&journal->j_state_lock);
++
++out:
++ return ret;
+ }
+
+ /*
+@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *jour
+ return jbd2_journal_start_thread(journal);
+ }
+
+-static void jbd2_write_superblock(journal_t *journal, int write_op)
++static int jbd2_write_superblock(journal_t *journal, int write_op)
+ {
+ struct buffer_head *bh = journal->j_sb_buffer;
+ journal_superblock_t *sb = journal->j_superblock;
+@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journa
+ printk(KERN_ERR "JBD2: Error %d detected when updating "
+ "journal superblock for %s.\n", ret,
+ journal->j_devname);
++ jbd2_journal_abort(journal, ret);
+ }
++
++ return ret;
+ }
+
+ /**
+@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journa
+ * Update a journal's superblock information about log tail and write it to
+ * disk, waiting for the IO to complete.
+ */
+-void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
++int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
+ unsigned long tail_block, int write_op)
+ {
+ journal_superblock_t *sb = journal->j_superblock;
++ int ret;
+
+ BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
+ jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
+@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(jou
+ sb->s_sequence = cpu_to_be32(tail_tid);
+ sb->s_start = cpu_to_be32(tail_block);
+
+- jbd2_write_superblock(journal, write_op);
++ ret = jbd2_write_superblock(journal, write_op);
++ if (ret)
++ goto out;
+
+ /* Log is no longer empty */
+ write_lock(&journal->j_state_lock);
+ WARN_ON(!sb->s_sequence);
+ journal->j_flags &= ~JBD2_FLUSHED;
+ write_unlock(&journal->j_state_lock);
++
++out:
++ return ret;
+ }
+
+ /**
+@@ -1950,7 +1966,14 @@ int jbd2_journal_flush(journal_t *journa
+ return -EIO;
+
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_cleanup_journal_tail(journal);
++ if (!err) {
++ err = jbd2_cleanup_journal_tail(journal);
++ if (err < 0) {
++ mutex_unlock(&journal->j_checkpoint_mutex);
++ goto out;
++ }
++ err = 0;
++ }
+
+ /* Finally, mark the journal as really needing no recovery.
+ * This sets s_start==0 in the underlying superblock, which is
+@@ -1966,7 +1989,8 @@ int jbd2_journal_flush(journal_t *journa
+ J_ASSERT(journal->j_head == journal->j_tail);
+ J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
+ write_unlock(&journal->j_state_lock);
+- return 0;
++out:
++ return err;
+ }
+
+ /**
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_des
+ int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
+ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
+ unsigned long *block);
+-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
+ void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
+
+ /* Commit management */
+@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (j
+ extern int jbd2_journal_wipe (journal_t *, int);
+ extern int jbd2_journal_skip_recovery (journal_t *);
+ extern void jbd2_journal_update_sb_errno(journal_t *);
+-extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
++extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
+ unsigned long, int);
+ extern void __jbd2_journal_abort_hard (journal_t *);
+ extern void jbd2_journal_abort (journal_t *, int);
--- /dev/null
+From b4f1afcd068f6e533230dfed00782cd8a907f96b Mon Sep 17 00:00:00 2001
+From: Dmitry Monakhov <dmonakhov@openvz.org>
+Date: Mon, 15 Jun 2015 00:18:02 -0400
+Subject: jbd2: use GFP_NOFS in jbd2_cleanup_journal_tail()
+
+From: Dmitry Monakhov <dmonakhov@openvz.org>
+
+commit b4f1afcd068f6e533230dfed00782cd8a907f96b upstream.
+
+jbd2_cleanup_journal_tail() can be invoked by jbd2__journal_start()
+So allocations should be done with GFP_NOFS
+
+[Full stack trace snipped from 3.10-rh7]
+[<ffffffff815c4bd4>] dump_stack+0x19/0x1b
+[<ffffffff8105dba1>] warn_slowpath_common+0x61/0x80
+[<ffffffff8105dcca>] warn_slowpath_null+0x1a/0x20
+[<ffffffff815c2142>] slab_pre_alloc_hook.isra.31.part.32+0x15/0x17
+[<ffffffff8119c045>] kmem_cache_alloc+0x55/0x210
+[<ffffffff811477f5>] ? mempool_alloc_slab+0x15/0x20
+[<ffffffff811477f5>] mempool_alloc_slab+0x15/0x20
+[<ffffffff81147939>] mempool_alloc+0x69/0x170
+[<ffffffff815cb69e>] ? _raw_spin_unlock_irq+0xe/0x20
+[<ffffffff8109160d>] ? finish_task_switch+0x5d/0x150
+[<ffffffff811f1a8e>] bio_alloc_bioset+0x1be/0x2e0
+[<ffffffff8127ee49>] blkdev_issue_flush+0x99/0x120
+[<ffffffffa019a733>] jbd2_cleanup_journal_tail+0x93/0xa0 [jbd2] -->GFP_KERNEL
+[<ffffffffa019aca1>] jbd2_log_do_checkpoint+0x221/0x4a0 [jbd2]
+[<ffffffffa019afc7>] __jbd2_log_wait_for_space+0xa7/0x1e0 [jbd2]
+[<ffffffffa01952d8>] start_this_handle+0x2d8/0x550 [jbd2]
+[<ffffffff811b02a9>] ? __memcg_kmem_put_cache+0x29/0x30
+[<ffffffff8119c120>] ? kmem_cache_alloc+0x130/0x210
+[<ffffffffa019573a>] jbd2__journal_start+0xba/0x190 [jbd2]
+[<ffffffff811532ce>] ? lru_cache_add+0xe/0x10
+[<ffffffffa01c9549>] ? ext4_da_write_begin+0xf9/0x330 [ext4]
+[<ffffffffa01f2c77>] __ext4_journal_start_sb+0x77/0x160 [ext4]
+[<ffffffffa01c9549>] ext4_da_write_begin+0xf9/0x330 [ext4]
+[<ffffffff811446ec>] generic_file_buffered_write_iter+0x10c/0x270
+[<ffffffff81146918>] __generic_file_write_iter+0x178/0x390
+[<ffffffff81146c6b>] __generic_file_aio_write+0x8b/0xb0
+[<ffffffff81146ced>] generic_file_aio_write+0x5d/0xc0
+[<ffffffffa01bf289>] ext4_file_write+0xa9/0x450 [ext4]
+[<ffffffff811c31d9>] ? pipe_read+0x379/0x4f0
+[<ffffffff811b93f0>] do_sync_write+0x90/0xe0
+[<ffffffff811b9b6d>] vfs_write+0xbd/0x1e0
+[<ffffffff811ba5b8>] SyS_write+0x58/0xb0
+[<ffffffff815d4799>] system_call_fastpath+0x16/0x1b
+
+Signed-off-by: Dmitry Monakhov <dmonakhov@openvz.org>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/checkpoint.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -405,7 +405,7 @@ int jbd2_cleanup_journal_tail(journal_t
+ * jbd2_cleanup_journal_tail() doesn't get called all that often.
+ */
+ if (journal->j_flags & JBD2_BARRIER)
+- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
++ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
+
+ __jbd2_update_log_tail(journal, first_tid, blocknr);
+ return 0;
--- /dev/null
+From 08c85d2a599d967ede38a847f5594447b6100642 Mon Sep 17 00:00:00 2001
+From: Aleksei Mamlin <mamlinav@gmail.com>
+Date: Wed, 1 Jul 2015 13:48:30 +0300
+Subject: libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER
+
+From: Aleksei Mamlin <mamlinav@gmail.com>
+
+commit 08c85d2a599d967ede38a847f5594447b6100642 upstream.
+
+Enabling AA on HP 250GB SATA disk VB0250EAVER causes errors:
+
+[ 3.788362] ata3.00: failed to enable AA (error_mask=0x1)
+[ 3.789243] ata3.00: failed to enable AA (error_mask=0x1)
+
+Add the ATA_HORKAGE_BROKEN_FPDMA_AA for this specific harddisk.
+
+tj: Collected FPDMA_AA entries and updated comment.
+
+Signed-off-by: Aleksei Mamlin <mamlinav@gmail.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4174,9 +4174,10 @@ static const struct ata_blacklist_entry
+ { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ |
+ ATA_HORKAGE_FIRMWARE_WARN },
+
+- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
++ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */
+ { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+ { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
++ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA },
+
+ /* Blacklist entries taken from Silicon Image 3124/3132
+ Windows driver .inf file - also several Linux problem reports */
--- /dev/null
+From af34d637637eabaf49406eb35c948cd51ba262a6 Mon Sep 17 00:00:00 2001
+From: David Milburn <dmilburn@redhat.com>
+Date: Mon, 13 Jul 2015 11:48:23 -0500
+Subject: libata: add ATA_HORKAGE_MAX_SEC_1024 to revert back to previous max_sectors limit
+
+From: David Milburn <dmilburn@redhat.com>
+
+commit af34d637637eabaf49406eb35c948cd51ba262a6 upstream.
+
+Since no longer limiting max_sectors to BLK_DEF_MAX_SECTORS (commit 34b48db66e08),
+data corruption may occur on ST380013AS drive configured on 82801JI (ICH10 Family)
+SATA controller. This patch will allow the driver to limit max_sectors as before
+
+ # cat /sys/block/sdb/queue/max_sectors_kb
+ 512
+
+I was able to double the max_sectors_kb value up to 16384 on linux-4.2.0-rc2
+before seeing corruption, but seems safer to use previous limit. Without this
+patch max_sectors_kb will be 32767.
+
+tj: Minor comment update.
+
+Reported-by: Jeff Moyer <jmoyer@redhat.com>
+Signed-off-by: David Milburn <dmilburn@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Fixes: 34b48db66e08 ("block: remove artifical max_hw_sectors cap")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c | 10 ++++++++++
+ include/linux/ata.h | 1 +
+ include/linux/libata.h | 2 +-
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2478,6 +2478,10 @@ int ata_dev_configure(struct ata_device
+ dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
+ dev->max_sectors);
+
++ if (dev->horkage & ATA_HORKAGE_MAX_SEC_1024)
++ dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_1024,
++ dev->max_sectors);
++
+ if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
+ dev->max_sectors = ATA_MAX_SECTORS_LBA48;
+
+@@ -4146,6 +4150,12 @@ static const struct ata_blacklist_entry
+ { "Slimtype DVD A DS8A8SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 },
+ { "Slimtype DVD A DS8A9SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 },
+
++ /*
++ * Causes silent data corruption with higher max sects.
++ * http://lkml.kernel.org/g/x49wpy40ysk.fsf@segfault.boston.devel.redhat.com
++ */
++ { "ST380013AS", "3.20", ATA_HORKAGE_MAX_SEC_1024 },
++
+ /* Devices we expect to fail diagnostics */
+
+ /* Devices where NCQ should be avoided */
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -45,6 +45,7 @@ enum {
+ ATA_SECT_SIZE = 512,
+ ATA_MAX_SECTORS_128 = 128,
+ ATA_MAX_SECTORS = 256,
++ ATA_MAX_SECTORS_1024 = 1024,
+ ATA_MAX_SECTORS_LBA48 = 65535,/* TODO: 65536? */
+ ATA_MAX_SECTORS_TAPE = 65535,
+
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -433,7 +433,7 @@ enum {
+ ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
+ ATA_HORKAGE_NO_NCQ_LOG = (1 << 23), /* don't use NCQ for log read */
+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
+-
++ ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */
+
+ /* DMA mask for user DMA control: User visible values; DO NOT
+ renumber */
--- /dev/null
+From 71d126fd28de2d4d9b7b2088dbccd7ca62fad6e0 Mon Sep 17 00:00:00 2001
+From: Arne Fitzenreiter <arne_f@ipfire.org>
+Date: Wed, 15 Jul 2015 13:54:36 +0200
+Subject: libata: add ATA_HORKAGE_NOTRIM
+
+From: Arne Fitzenreiter <arne_f@ipfire.org>
+
+commit 71d126fd28de2d4d9b7b2088dbccd7ca62fad6e0 upstream.
+
+Some devices lose data on TRIM whether queued or not. This patch adds
+a horkage to disable TRIM.
+
+tj: Collapsed unnecessary if() nesting.
+
+Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-scsi.c | 3 ++-
+ drivers/ata/libata-transport.c | 2 ++
+ include/linux/libata.h | 2 ++
+ 3 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -2568,7 +2568,8 @@ static unsigned int ata_scsiop_read_cap(
+ rbuf[14] = (lowest_aligned >> 8) & 0x3f;
+ rbuf[15] = lowest_aligned;
+
+- if (ata_id_has_trim(args->id)) {
++ if (ata_id_has_trim(args->id) &&
++ !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
+ rbuf[14] |= 0x80; /* LBPME */
+
+ if (ata_id_has_zero_after_trim(args->id) &&
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -569,6 +569,8 @@ show_ata_dev_trim(struct device *dev,
+
+ if (!ata_id_has_trim(ata_dev->id))
+ mode = "unsupported";
++ else if (ata_dev->horkage & ATA_HORKAGE_NOTRIM)
++ mode = "forced_unsupported";
+ else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM)
+ mode = "forced_unqueued";
+ else if (ata_fpdma_dsm_supported(ata_dev))
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -432,6 +432,8 @@ enum {
+ ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */
+ ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
+ ATA_HORKAGE_NO_NCQ_LOG = (1 << 23), /* don't use NCQ for log read */
++ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
++
+
+ /* DMA mask for user DMA control: User visible values; DO NOT
+ renumber */
--- /dev/null
+From 9051bd393cf25e76dfb45409792719a854661500 Mon Sep 17 00:00:00 2001
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+Date: Wed, 15 Jul 2015 21:03:23 -0400
+Subject: libata: Do not blacklist M510DC
+
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+
+commit 9051bd393cf25e76dfb45409792719a854661500 upstream.
+
+A new Micron drive was just announced, once again recycling the first
+part of the model string. Add an underscore to the M510/M550 pattern to
+avoid picking up the new DC drive.
+
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4240,7 +4240,7 @@ static const struct ata_blacklist_entry
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+- { "Micron_M5[15]0*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
++ { "Micron_M5[15]0_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Crucial_CT*M550*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
--- /dev/null
+From 243918be6393f643e513a26e7882e6ae06ff7717 Mon Sep 17 00:00:00 2001
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+Date: Thu, 18 Jun 2015 14:50:18 -0400
+Subject: libata: Do not blacklist Micron M500DC
+
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+
+commit 243918be6393f643e513a26e7882e6ae06ff7717 upstream.
+
+Queued TRIM got disabled on Micron M500DC drives thanks to the
+"Micron_M500*" pattern we had in place to accommodate the previous
+generation of this drive family. Tweak the blacklist entry slightly so
+we only disable queued TRIM for the non-DC variants of M500 drives.
+
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4225,7 +4225,7 @@ static const struct ata_blacklist_entry
+ { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER },
+
+ /* devices that don't properly handle queued TRIM commands */
+- { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
++ { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+ { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
--- /dev/null
+From f303074160d3401970ccae082014e1ee5a9a52c5 Mon Sep 17 00:00:00 2001
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+Date: Mon, 4 May 2015 21:54:19 -0400
+Subject: libata: Expose TRIM capability in sysfs
+
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+
+commit f303074160d3401970ccae082014e1ee5a9a52c5 upstream.
+
+Create a sysfs "trim" attribute for each ata_device that displays
+whether DSM TRIM is "unsupported", "unqueued", "forced_unqueued"
+(blacklisted) or "queued".
+
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/ABI/testing/sysfs-ata | 11 +++++++++++
+ drivers/ata/libata-transport.c | 22 ++++++++++++++++++++++
+ 2 files changed, 33 insertions(+)
+
+--- a/Documentation/ABI/testing/sysfs-ata
++++ b/Documentation/ABI/testing/sysfs-ata
+@@ -90,6 +90,17 @@ gscr
+ 130: SATA_PMP_GSCR_SII_GPIO
+ Only valid if the device is a PM.
+
++trim
++
++ Shows the DSM TRIM mode currently used by the device. Valid
++ values are:
++ unsupported: Drive does not support DSM TRIM
++ unqueued: Drive supports unqueued DSM TRIM only
++ queued: Drive supports queued DSM TRIM
++ forced_unqueued: Drive's unqueued DSM support is known to be
++ buggy and only unqueued TRIM commands
++ are sent
++
+ spdn_cnt
+
+ Number of time libata decided to lower the speed of link due to errors.
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -560,6 +560,27 @@ show_ata_dev_gscr(struct device *dev,
+
+ static DEVICE_ATTR(gscr, S_IRUGO, show_ata_dev_gscr, NULL);
+
++static ssize_t
++show_ata_dev_trim(struct device *dev,
++ struct device_attribute *attr, char *buf)
++{
++ struct ata_device *ata_dev = transport_class_to_dev(dev);
++ unsigned char *mode;
++
++ if (!ata_id_has_trim(ata_dev->id))
++ mode = "unsupported";
++ else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM)
++ mode = "forced_unqueued";
++ else if (ata_fpdma_dsm_supported(ata_dev))
++ mode = "queued";
++ else
++ mode = "unqueued";
++
++ return snprintf(buf, 20, "%s\n", mode);
++}
++
++static DEVICE_ATTR(trim, S_IRUGO, show_ata_dev_trim, NULL);
++
+ static DECLARE_TRANSPORT_CLASS(ata_dev_class,
+ "ata_device", NULL, NULL, NULL);
+
+@@ -733,6 +754,7 @@ struct scsi_transport_template *ata_atta
+ SETUP_DEV_ATTRIBUTE(ering);
+ SETUP_DEV_ATTRIBUTE(id);
+ SETUP_DEV_ATTRIBUTE(gscr);
++ SETUP_DEV_ATTRIBUTE(trim);
+ BUG_ON(count > ATA_DEV_ATTRS);
+ i->dev_attrs[count] = NULL;
+
--- /dev/null
+From 5d3abf8ff67f49271a42c0f7fa4f20f9e046bf0e Mon Sep 17 00:00:00 2001
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+Date: Mon, 4 May 2015 21:54:21 -0400
+Subject: libata: Fall back to unqueued READ LOG EXT if the DMA variant fails
+
+From: "Martin K. Petersen" <martin.petersen@oracle.com>
+
+commit 5d3abf8ff67f49271a42c0f7fa4f20f9e046bf0e upstream.
+
+Some devices advertise support for the READ/WRITE LOG DMA EXT commands
+but fail when we try to issue them. This can lead to queued TRIM being
+unintentionally disabled since the relevant feature flag is located in a
+general purpose log page.
+
+Fall back to unqueued READ LOG EXT if the DMA variant fails while
+reading a log page.
+
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-eh.c | 12 +++++++++++-
+ include/linux/libata.h | 1 +
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -1507,13 +1507,17 @@ unsigned int ata_read_log_page(struct at
+ {
+ struct ata_taskfile tf;
+ unsigned int err_mask;
++ bool dma = false;
+
+ DPRINTK("read log page - log 0x%x, page 0x%x\n", log, page);
+
++retry:
+ ata_tf_init(dev, &tf);
+- if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id)) {
++ if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) &&
++ !(dev->horkage & ATA_HORKAGE_NO_NCQ_LOG)) {
+ tf.command = ATA_CMD_READ_LOG_DMA_EXT;
+ tf.protocol = ATA_PROT_DMA;
++ dma = true;
+ } else {
+ tf.command = ATA_CMD_READ_LOG_EXT;
+ tf.protocol = ATA_PROT_PIO;
+@@ -1527,6 +1531,12 @@ unsigned int ata_read_log_page(struct at
+ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_FROM_DEVICE,
+ buf, sectors * ATA_SECT_SIZE, 0);
+
++ if (err_mask && dma) {
++ dev->horkage |= ATA_HORKAGE_NO_NCQ_LOG;
++ ata_dev_warn(dev, "READ LOG DMA EXT failed, trying unqueued\n");
++ goto retry;
++ }
++
+ DPRINTK("EXIT, err_mask=%x\n", err_mask);
+ return err_mask;
+ }
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -431,6 +431,7 @@ enum {
+ ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */
+ ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */
+ ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
++ ATA_HORKAGE_NO_NCQ_LOG = (1 << 23), /* don't use NCQ for log read */
+
+ /* DMA mask for user DMA control: User visible values; DO NOT
+ renumber */
--- /dev/null
+From cda57b1b05cf7b8b99ab4b732bea0b05b6c015cc Mon Sep 17 00:00:00 2001
+From: Arne Fitzenreiter <arne_f@ipfire.org>
+Date: Wed, 15 Jul 2015 13:54:37 +0200
+Subject: libata: force disable trim for SuperSSpeed S238
+
+From: Arne Fitzenreiter <arne_f@ipfire.org>
+
+commit cda57b1b05cf7b8b99ab4b732bea0b05b6c015cc upstream.
+
+This device loses blocks, often the partition table area, on trim.
+Disable TRIM.
+http://pcengines.ch/msata16a.htm
+
+Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4249,6 +4249,9 @@ static const struct ata_blacklist_entry
+ { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
+ ATA_HORKAGE_ZERO_AFTER_TRIM, },
+
++ /* devices that don't properly handle TRIM commands */
++ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, },
++
+ /*
+ * As defined, the DRAT (Deterministic Read After Trim) and RZAT
+ * (Return Zero After Trim) flags in the ATA Command Set are
--- /dev/null
+From d531be2ca2f27cca5f041b6a140504999144a617 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Wed, 8 Jul 2015 13:06:12 -0400
+Subject: libata: increase the timeout when setting transfer mode
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit d531be2ca2f27cca5f041b6a140504999144a617 upstream.
+
+I have a ST4000DM000 disk. If Linux is booted while the disk is spun down,
+the command that sets transfer mode causes the disk to spin up. The
+spin-up takes longer than the default 5s timeout, so the command fails and
+timeout is reported.
+
+Fix this by increasing the timeout to 15s, which is enough for the disk to
+spin up.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/libata-core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4502,7 +4502,8 @@ static unsigned int ata_dev_set_xfermode
+ else /* In the ancient relic department - skip all of this */
+ return 0;
+
+- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
++ /* On some disks, this command causes spin-up, so we need longer timeout */
++ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
+
+ DPRINTK("EXIT, err_mask=%x\n", err_mask);
+ return err_mask;
--- /dev/null
+From e989a73ebd09d22c22ead51fa363a2f56f70f28a Mon Sep 17 00:00:00 2001
+From: Thomas Reitmayr <treitmayr@devbase.at>
+Date: Fri, 1 May 2015 20:18:04 -0300
+Subject: [media] media: Fix regression in some more dib0700 based devices
+
+From: Thomas Reitmayr <treitmayr@devbase.at>
+
+commit e989a73ebd09d22c22ead51fa363a2f56f70f28a upstream.
+
+Fix an oops during device initialization by correctly setting size_of_priv
+instead of leaving it 0.
+The regression was introduced by 8abe4a0a3f6d4217b16a ("[media] dib7000:
+export just one symbol") and only fixed for one type of dib0700 based
+devices in 9e334c75642b6e5bfb95 ("[media] Fix regression in some dib0700
+based devices").
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=92301
+
+Fixes: 8abe4a0a3f6d4217b16a ("[media] dib7000: export just one symbol")
+
+Signed-off-by: Thomas Reitmayr <treitmayr@devbase.at>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb/dib0700_devices.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/media/usb/dvb-usb/dib0700_devices.c
++++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
+@@ -3944,6 +3944,8 @@ struct dvb_usb_device_properties dib0700
+
+ DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
+ }},
++ .size_of_priv = sizeof(struct
++ dib0700_adapter_state),
+ }, {
+ .num_frontends = 1,
+ .fe = {{
+@@ -3956,6 +3958,8 @@ struct dvb_usb_device_properties dib0700
+
+ DIB0700_DEFAULT_STREAMING_CONFIG(0x03),
+ }},
++ .size_of_priv = sizeof(struct
++ dib0700_adapter_state),
+ }
+ },
+
+@@ -4009,6 +4013,8 @@ struct dvb_usb_device_properties dib0700
+
+ DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
+ }},
++ .size_of_priv = sizeof(struct
++ dib0700_adapter_state),
+ },
+ },
+
--- /dev/null
+From 09f39a950523b1bb830c30a8670b77e0067da092 Mon Sep 17 00:00:00 2001
+From: Christophe Ricard <christophe.ricard@gmail.com>
+Date: Sat, 6 Jun 2015 13:16:43 +0200
+Subject: NFC: st21nfcb: Do not remove header once the payload is sent
+
+From: Christophe Ricard <christophe.ricard@gmail.com>
+
+commit 09f39a950523b1bb830c30a8670b77e0067da092 upstream.
+
+Once the data is sent, we need to preserve the full frame for
+the ndlc state machine. If the NDLC ACK is not received in time,
+the ndlc layer will resend the same frame.
+Having the header byte pulled will corrupt the frame.
+
+Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nfc/st21nfcb/i2c.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+--- a/drivers/nfc/st21nfcb/i2c.c
++++ b/drivers/nfc/st21nfcb/i2c.c
+@@ -87,11 +87,6 @@ static void st21nfcb_nci_i2c_disable(voi
+ gpio_set_value(phy->gpio_reset, 1);
+ }
+
+-static void st21nfcb_nci_remove_header(struct sk_buff *skb)
+-{
+- skb_pull(skb, ST21NFCB_FRAME_HEADROOM);
+-}
+-
+ /*
+ * Writing a frame must not return the number of written bytes.
+ * It must return either zero for success, or <0 for error.
+@@ -121,8 +116,6 @@ static int st21nfcb_nci_i2c_write(void *
+ r = 0;
+ }
+
+- st21nfcb_nci_remove_header(skb);
+-
+ return r;
+ }
+
--- /dev/null
+From 38bd83f04c5e9695011dc5c294e0c4e6a9f9052d Mon Sep 17 00:00:00 2001
+From: Firo Yang <firogm@gmail.com>
+Date: Sat, 6 Jun 2015 13:16:42 +0200
+Subject: NFC: st21nfcb: Remove inappropriate kfree on a devm_kzalloc pointer
+
+From: Firo Yang <firogm@gmail.com>
+
+commit 38bd83f04c5e9695011dc5c294e0c4e6a9f9052d upstream.
+
+Since ndev->driver_data is allocated by devm_kzalloc(), we do not
+need the inappropriate kfree to free it in driver's remove function.
+Freeing will trigger when driver unloads.
+
+Acked-by: Christophe Ricard <christophe-h.ricard@st.com>
+Signed-off-by: Firo Yang <firogm@gmail.com>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nfc/st21nfcb/st21nfcb.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/nfc/st21nfcb/st21nfcb.c
++++ b/drivers/nfc/st21nfcb/st21nfcb.c
+@@ -131,11 +131,8 @@ EXPORT_SYMBOL_GPL(st21nfcb_nci_probe);
+
+ void st21nfcb_nci_remove(struct nci_dev *ndev)
+ {
+- struct st21nfcb_nci_info *info = nci_get_drvdata(ndev);
+-
+ nci_unregister_device(ndev);
+ nci_free_device(ndev);
+- kfree(info);
+ }
+ EXPORT_SYMBOL_GPL(st21nfcb_nci_remove);
+
--- /dev/null
+From 4ac82e894825126816d7b7f662743335ce2b015e Mon Sep 17 00:00:00 2001
+From: Christophe Ricard <christophe.ricard@gmail.com>
+Date: Sat, 6 Jun 2015 13:16:44 +0200
+Subject: NFC: st21nfcb: remove st21nfcb_nci_i2c_disable
+
+From: Christophe Ricard <christophe.ricard@gmail.com>
+
+commit 4ac82e894825126816d7b7f662743335ce2b015e upstream.
+
+ndlc_remove already calls st21nfcb_nci_i2c_disable and
+phy->powered is already set to 0.
+
+Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
+Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nfc/st21nfcb/i2c.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/nfc/st21nfcb/i2c.c
++++ b/drivers/nfc/st21nfcb/i2c.c
+@@ -359,9 +359,6 @@ static int st21nfcb_nci_i2c_remove(struc
+
+ ndlc_remove(phy->ndlc);
+
+- if (phy->powered)
+- st21nfcb_nci_i2c_disable(phy);
+-
+ return 0;
+ }
+
--- /dev/null
+From 4d298b8539ed59f1d69d3aa6e41a2c4908137612 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20H=C3=A4rdeman?= <david@hardeman.nu>
+Date: Mon, 30 Mar 2015 17:51:01 -0300
+Subject: [media] rc-core: fix dib0700 scancode generation for RC5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: =?UTF-8?q?David=20H=C3=A4rdeman?= <david@hardeman.nu>
+
+commit 4d298b8539ed59f1d69d3aa6e41a2c4908137612 upstream.
+
+commit af3a4a9bbeb0 ("[media] dib0700: NEC scancode cleanup") cleaned
+up the NEC scancode logic but overlooked the RC5 case.
+
+This patch brings the RC5 case in line with the NEC code and makes
+the struct self-documenting.
+
+Signed-off-by: David Härdeman <david@hardeman.nu>
+Reported-by: David Cimbůrek <david.cimburek@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/dvb-usb/dib0700_core.c | 70 +++++++++++++++++--------------
+ 1 file changed, 40 insertions(+), 30 deletions(-)
+
+--- a/drivers/media/usb/dvb-usb/dib0700_core.c
++++ b/drivers/media/usb/dvb-usb/dib0700_core.c
+@@ -655,10 +655,20 @@ out:
+ struct dib0700_rc_response {
+ u8 report_id;
+ u8 data_state;
+- u8 system;
+- u8 not_system;
+- u8 data;
+- u8 not_data;
++ union {
++ struct {
++ u8 system;
++ u8 not_system;
++ u8 data;
++ u8 not_data;
++ } nec;
++ struct {
++ u8 not_used;
++ u8 system;
++ u8 data;
++ u8 not_data;
++ } rc5;
++ };
+ };
+ #define RC_MSG_SIZE_V1_20 6
+
+@@ -694,8 +704,8 @@ static void dib0700_rc_urb_completion(st
+
+ deb_data("IR ID = %02X state = %02X System = %02X %02X Cmd = %02X %02X (len %d)\n",
+ poll_reply->report_id, poll_reply->data_state,
+- poll_reply->system, poll_reply->not_system,
+- poll_reply->data, poll_reply->not_data,
++ poll_reply->nec.system, poll_reply->nec.not_system,
++ poll_reply->nec.data, poll_reply->nec.not_data,
+ purb->actual_length);
+
+ switch (d->props.rc.core.protocol) {
+@@ -704,30 +714,30 @@ static void dib0700_rc_urb_completion(st
+ toggle = 0;
+
+ /* NEC protocol sends repeat code as 0 0 0 FF */
+- if (poll_reply->system == 0x00 &&
+- poll_reply->not_system == 0x00 &&
+- poll_reply->data == 0x00 &&
+- poll_reply->not_data == 0xff) {
++ if (poll_reply->nec.system == 0x00 &&
++ poll_reply->nec.not_system == 0x00 &&
++ poll_reply->nec.data == 0x00 &&
++ poll_reply->nec.not_data == 0xff) {
+ poll_reply->data_state = 2;
+ break;
+ }
+
+- if ((poll_reply->data ^ poll_reply->not_data) != 0xff) {
++ if ((poll_reply->nec.data ^ poll_reply->nec.not_data) != 0xff) {
+ deb_data("NEC32 protocol\n");
+- keycode = RC_SCANCODE_NEC32(poll_reply->system << 24 |
+- poll_reply->not_system << 16 |
+- poll_reply->data << 8 |
+- poll_reply->not_data);
+- } else if ((poll_reply->system ^ poll_reply->not_system) != 0xff) {
++ keycode = RC_SCANCODE_NEC32(poll_reply->nec.system << 24 |
++ poll_reply->nec.not_system << 16 |
++ poll_reply->nec.data << 8 |
++ poll_reply->nec.not_data);
++ } else if ((poll_reply->nec.system ^ poll_reply->nec.not_system) != 0xff) {
+ deb_data("NEC extended protocol\n");
+- keycode = RC_SCANCODE_NECX(poll_reply->system << 8 |
+- poll_reply->not_system,
+- poll_reply->data);
++ keycode = RC_SCANCODE_NECX(poll_reply->nec.system << 8 |
++ poll_reply->nec.not_system,
++ poll_reply->nec.data);
+
+ } else {
+ deb_data("NEC normal protocol\n");
+- keycode = RC_SCANCODE_NEC(poll_reply->system,
+- poll_reply->data);
++ keycode = RC_SCANCODE_NEC(poll_reply->nec.system,
++ poll_reply->nec.data);
+ }
+
+ break;
+@@ -735,17 +745,17 @@ static void dib0700_rc_urb_completion(st
+ deb_data("RC5 protocol\n");
+ protocol = RC_TYPE_RC5;
+ toggle = poll_reply->report_id;
+- keycode = RC_SCANCODE_RC5(poll_reply->system, poll_reply->data);
++ keycode = RC_SCANCODE_RC5(poll_reply->rc5.system, poll_reply->rc5.data);
+
+- break;
+- }
++ if ((poll_reply->rc5.data ^ poll_reply->rc5.not_data) != 0xff) {
++ /* Key failed integrity check */
++ err("key failed integrity check: %02x %02x %02x %02x",
++ poll_reply->rc5.not_used, poll_reply->rc5.system,
++ poll_reply->rc5.data, poll_reply->rc5.not_data);
++ goto resubmit;
++ }
+
+- if ((poll_reply->data + poll_reply->not_data) != 0xff) {
+- /* Key failed integrity check */
+- err("key failed integrity check: %02x %02x %02x %02x",
+- poll_reply->system, poll_reply->not_system,
+- poll_reply->data, poll_reply->not_data);
+- goto resubmit;
++ break;
+ }
+
+ rc_keydown(d->rc_dev, protocol, keycode, toggle);
--- /dev/null
+From 119434f44c78df8c4b6d67f835448542a4bd7e91 Mon Sep 17 00:00:00 2001
+From: Stefan Agner <stefan@agner.ch>
+Date: Thu, 21 May 2015 17:29:35 +0200
+Subject: rtc: snvs: fix wakealarm by call enable_irq_wake earlier
+
+From: Stefan Agner <stefan@agner.ch>
+
+commit 119434f44c78df8c4b6d67f835448542a4bd7e91 upstream.
+
+When entering suspend while an wakeup alarm is set, enable_set_wake
+should make sure that the RTC interrupt keep being enabled and the
+.irq_set_wake for the RTC interrupt get called. However, since the
+driver uses the suspend_noirq callback, the call to enable_irq_wake
+has been made after disabling the interrupts. While .irq_set_wake
+has been called properly, the interrupt remained disabled.
+
+Use the suspend callback to call enable_irq_wake early enough to
+ensure the RTC interrupt remains enabled.
+
+Fixes: 7654e9d4fd8f ("drivers/rtc/rtc-snvs: fix suspend/resume")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-snvs.c | 30 +++++++++++++++++++++---------
+ 1 file changed, 21 insertions(+), 9 deletions(-)
+
+--- a/drivers/rtc/rtc-snvs.c
++++ b/drivers/rtc/rtc-snvs.c
+@@ -322,6 +322,13 @@ static int snvs_rtc_suspend(struct devic
+ if (device_may_wakeup(dev))
+ enable_irq_wake(data->irq);
+
++ return 0;
++}
++
++static int snvs_rtc_suspend_noirq(struct device *dev)
++{
++ struct snvs_rtc_data *data = dev_get_drvdata(dev);
++
+ if (data->clk)
+ clk_disable_unprepare(data->clk);
+
+@@ -331,23 +338,28 @@ static int snvs_rtc_suspend(struct devic
+ static int snvs_rtc_resume(struct device *dev)
+ {
+ struct snvs_rtc_data *data = dev_get_drvdata(dev);
+- int ret;
+
+ if (device_may_wakeup(dev))
+- disable_irq_wake(data->irq);
++ return disable_irq_wake(data->irq);
+
+- if (data->clk) {
+- ret = clk_prepare_enable(data->clk);
+- if (ret)
+- return ret;
+- }
++ return 0;
++}
++
++static int snvs_rtc_resume_noirq(struct device *dev)
++{
++ struct snvs_rtc_data *data = dev_get_drvdata(dev);
++
++ if (data->clk)
++ return clk_prepare_enable(data->clk);
+
+ return 0;
+ }
+
+ static const struct dev_pm_ops snvs_rtc_pm_ops = {
+- .suspend_noirq = snvs_rtc_suspend,
+- .resume_noirq = snvs_rtc_resume,
++ .suspend = snvs_rtc_suspend,
++ .suspend_noirq = snvs_rtc_suspend_noirq,
++ .resume = snvs_rtc_resume,
++ .resume_noirq = snvs_rtc_resume_noirq,
+ };
+
+ #define SNVS_RTC_PM_OPS (&snvs_rtc_pm_ops)
--- /dev/null
+From 1277fa2ab2f9a624a4b0177119ca13b5fd65edd0 Mon Sep 17 00:00:00 2001
+From: Vincent Fann <vincent_fann@realtek.com>
+Date: Fri, 15 May 2015 21:29:27 -0500
+Subject: rtlwifi: Remove the clear interrupt routine from all drivers
+
+From: Vincent Fann <vincent_fann@realtek.com>
+
+commit 1277fa2ab2f9a624a4b0177119ca13b5fd65edd0 upstream.
+
+Several of these drivers have there TX randomly blocked for 3~5 seconds while
+measuring tx throughput (iperf). The root couse happens in rtl_pci_flush().
+The function uses a while-loop to wait for TX queue length to decrease to 0.
+The TX queue length counts the number of packets that are queued in the driver.
+The driver relys on the TX OK interrupt to return skb and reduce TX queue length.
+
+The interrupt subroutine disables interupts, reads the interrupt registers, and
+then clears the registers in the beginning of _rtl_pci_interrupt(). After all
+interupts process are finished, the driver invokes enable_interrupt() to enable
+interupts. This behavior is normal for an interrupt subroutine.
+
+But enable_interrupt() invokes clear_interrupt() again. This unexpected interrupt
+clearing may cleari me fresh TX OK interrupts. These missing interrupts cause TX
+queue length to never reduce to 0i, which causes rtl_pci_flush() to be stuck in
+unterminated while-loop.
+
+This patch removes clear_interrupt() in enable_interrupt() to avoid this behavior.
+
+Signed-off-by: Vincent Fann <vincent_fann@realtek.com>
+Signed-off-by: Shao Fu <shaofu@realtek.com>
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/rtlwifi/rtl8188ee/hw.c | 16 ----------------
+ drivers/net/wireless/rtlwifi/rtl8192ee/hw.c | 17 -----------------
+ drivers/net/wireless/rtlwifi/rtl8723ae/hw.c | 13 -------------
+ drivers/net/wireless/rtlwifi/rtl8723be/hw.c | 17 -----------------
+ drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 20 --------------------
+ 5 files changed, 83 deletions(-)
+
+--- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
+@@ -1354,27 +1354,11 @@ void rtl88ee_set_qos(struct ieee80211_hw
+ }
+ }
+
+-static void rtl88ee_clear_interrupt(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- u32 tmp;
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISR);
+- rtl_write_dword(rtlpriv, REG_HISR, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
+- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
+-}
+-
+ void rtl88ee_enable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+- rtl88ee_clear_interrupt(hw);/*clear it here first*/
+ rtl_write_dword(rtlpriv, REG_HIMR,
+ rtlpci->irq_mask[0] & 0xFFFFFFFF);
+ rtl_write_dword(rtlpriv, REG_HIMRE,
+--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+@@ -1584,28 +1584,11 @@ void rtl92ee_set_qos(struct ieee80211_hw
+ }
+ }
+
+-static void rtl92ee_clear_interrupt(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- u32 tmp;
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISR);
+- rtl_write_dword(rtlpriv, REG_HISR, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
+- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
+-}
+-
+ void rtl92ee_enable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+- rtl92ee_clear_interrupt(hw);/*clear it here first*/
+-
+ rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
+ rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
+ rtlpci->irq_enabled = true;
+--- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
+@@ -1258,18 +1258,6 @@ void rtl8723e_set_qos(struct ieee80211_h
+ }
+ }
+
+-static void rtl8723e_clear_interrupt(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- u32 tmp;
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISR);
+- rtl_write_dword(rtlpriv, REG_HISR, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+-}
+-
+ void rtl8723e_enable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+@@ -1284,7 +1272,6 @@ void rtl8723e_disable_interrupt(struct i
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+- rtl8723e_clear_interrupt(hw);/*clear it here first*/
+ rtl_write_dword(rtlpriv, 0x3a8, IMR8190_DISABLED);
+ rtl_write_dword(rtlpriv, 0x3ac, IMR8190_DISABLED);
+ rtlpci->irq_enabled = false;
+--- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
+@@ -1634,28 +1634,11 @@ void rtl8723be_set_qos(struct ieee80211_
+ }
+ }
+
+-static void rtl8723be_clear_interrupt(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- u32 tmp;
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISR);
+- rtl_write_dword(rtlpriv, REG_HISR, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
+- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
+-}
+-
+ void rtl8723be_enable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+- rtl8723be_clear_interrupt(hw);/*clear it here first*/
+-
+ rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
+ rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
+ rtlpci->irq_enabled = true;
+--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+@@ -2253,31 +2253,11 @@ void rtl8821ae_set_qos(struct ieee80211_
+ }
+ }
+
+-static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw)
+-{
+- struct rtl_priv *rtlpriv = rtl_priv(hw);
+- u32 tmp;
+- tmp = rtl_read_dword(rtlpriv, REG_HISR);
+- /*printk("clear interrupt first:\n");
+- printk("0x%x = 0x%08x\n",REG_HISR, tmp);*/
+- rtl_write_dword(rtlpriv, REG_HISR, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+- /*printk("0x%x = 0x%08x\n",REG_HISRE, tmp);*/
+- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+-
+- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
+- /*printk("0x%x = 0x%08x\n",REG_HSISR, tmp);*/
+- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
+-}
+-
+ void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw)
+ {
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+
+- rtl8821ae_clear_interrupt(hw);/*clear it here first*/
+-
+ rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
+ rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
+ rtlpci->irq_enabled = true;
--- /dev/null
+From 12f4543f5d6811f864e6c4952eb27253c7466c02 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Tue, 28 Apr 2015 18:34:40 -0300
+Subject: [media] s5h1420: fix a buffer overflow when checking userspace params
+
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+
+commit 12f4543f5d6811f864e6c4952eb27253c7466c02 upstream.
+
+The maximum size for a DiSEqC command is 6, according to the
+userspace API. However, the code allows to write up to 7 values:
+ drivers/media/dvb-frontends/s5h1420.c:193 s5h1420_send_master_cmd() error: buffer overflow 'cmd->msg' 6 <= 7
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/s5h1420.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/dvb-frontends/s5h1420.c
++++ b/drivers/media/dvb-frontends/s5h1420.c
+@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (stru
+ int result = 0;
+
+ dprintk("enter %s\n", __func__);
+- if (cmd->msg_len > 8)
++ if (cmd->msg_len > sizeof(cmd->msg))
+ return -EINVAL;
+
+ /* setup for DISEQC */
--- /dev/null
+From 534bc3e2ee93835badca753bedce8073c67caa92 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Fri, 27 Mar 2015 15:17:56 -0300
+Subject: [media] saa7164: fix querycap warning
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 534bc3e2ee93835badca753bedce8073c67caa92 upstream.
+
+Fix the VIDIOC_QUERYCAP warning due to the missing device_caps. Don't fill
+in the version field, the V4L2 core will do that for you.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/pci/saa7164/saa7164-encoder.c | 11 ++++++-----
+ drivers/media/pci/saa7164/saa7164-vbi.c | 11 ++++++-----
+ 2 files changed, 12 insertions(+), 10 deletions(-)
+
+--- a/drivers/media/pci/saa7164/saa7164-encoder.c
++++ b/drivers/media/pci/saa7164/saa7164-encoder.c
+@@ -721,13 +721,14 @@ static int vidioc_querycap(struct file *
+ sizeof(cap->card));
+ sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
+
+- cap->capabilities =
++ cap->device_caps =
+ V4L2_CAP_VIDEO_CAPTURE |
+- V4L2_CAP_READWRITE |
+- 0;
++ V4L2_CAP_READWRITE |
++ V4L2_CAP_TUNER;
+
+- cap->capabilities |= V4L2_CAP_TUNER;
+- cap->version = 0;
++ cap->capabilities = cap->device_caps |
++ V4L2_CAP_VBI_CAPTURE |
++ V4L2_CAP_DEVICE_CAPS;
+
+ return 0;
+ }
+--- a/drivers/media/pci/saa7164/saa7164-vbi.c
++++ b/drivers/media/pci/saa7164/saa7164-vbi.c
+@@ -660,13 +660,14 @@ static int vidioc_querycap(struct file *
+ sizeof(cap->card));
+ sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
+
+- cap->capabilities =
++ cap->device_caps =
+ V4L2_CAP_VBI_CAPTURE |
+- V4L2_CAP_READWRITE |
+- 0;
++ V4L2_CAP_READWRITE |
++ V4L2_CAP_TUNER;
+
+- cap->capabilities |= V4L2_CAP_TUNER;
+- cap->version = 0;
++ cap->capabilities = cap->device_caps |
++ V4L2_CAP_VIDEO_CAPTURE |
++ V4L2_CAP_DEVICE_CAPS;
+
+ return 0;
+ }
openrisc-fix-config_uid16-setting.patch
m68knommu-make-coldfire-soc-selection-a-choice.patch
m68knommu-force-setting-of-config_clock_freq-for-coldfire.patch
+bluetooth-fix-race-condition-with-user-channel-and-setup-stage.patch
+bluetooth-btusb-fix-memory-leak-in-intel-setup-routine.patch
+bluetooth-btusb-fix-secure-send-command-length-alignment-on-intel-8260.patch
+bluetooth-btusb-correct-typo-in-roper-class-1-bluetooth-dongle.patch
+bluetooth-btbcm-allow-btbcm_read_verbose_config-to-fail-on-apple.patch
+ath9k-fix-dma-stop-sequence-for-ar9003.patch
+ath9k_htc-memory-corruption-calling-set_bit.patch
+rtlwifi-remove-the-clear-interrupt-routine-from-all-drivers.patch
+ieee802154-fix-sockaddr_ieee802154-implicit-padding-information-leak.patch
+staging-vt6656-check-ieee80211_bss_conf-bssid-not-null.patch
+staging-vt6655-check-ieee80211_bss_conf-bssid-not-null.patch
+staging-vt6655-device_rx_srv-check-sk_buff-is-null.patch
+staging-rtl8712-prevent-buffer-overrun-in-recvbuf2recvframe.patch
+staging-comedi-cb_pcimdas-fix-handlers-for-di-and-do-subdevices.patch
+hid-sensor-fix-suspend-resume-delay.patch
+ext4-fix-race-between-truncate-and-__ext4_journalled_writepage.patch
+ext4-call-sync_blockdev-before-invalidate_bdev-in-put_super.patch
+ext4-don-t-retry-file-block-mapping-on-bigalloc-fs-with-non-extent-file.patch
+ext4-set-lazytime-on-remount-if-ms_lazytime-is-set-by-mount.patch
+ext4-fix-fencepost-error-in-lazytime-optimization.patch
+bufferhead-add-_gfp-version-for-sb_getblk.patch
+ext4-avoid-deadlocks-in-the-writeback-path-by-using-sb_getblk_gfp.patch
+ext4-fix-reservation-release-on-invalidatepage-for-delalloc-fs.patch
+ext4-be-more-strict-when-migrating-to-non-extent-based-file.patch
+ext4-correctly-migrate-a-file-with-a-hole-at-the-beginning.patch
+ext4-replace-open-coded-nofail-allocation-in-ext4_free_blocks.patch
+jbd2-use-gfp_nofs-in-jbd2_cleanup_journal_tail.patch
+jbd2-fix-ocfs2-corrupt-when-updating-journal-superblock-fails.patch
+nfc-st21nfcb-remove-inappropriate-kfree-on-a-devm_kzalloc-pointer.patch
+nfc-st21nfcb-do-not-remove-header-once-the-payload-is-sent.patch
+nfc-st21nfcb-remove-st21nfcb_nci_i2c_disable.patch
+rtc-snvs-fix-wakealarm-by-call-enable_irq_wake-earlier.patch
+i2c-at91-fix-a-race-condition-when-using-the-dma-controller.patch
+i2c-mux-use-__i2c_transfer-instead-of-calling-parent-s-master_xfer.patch
+i2c-mux-pca954x-use-__i2c_transfer-because-of-quirks.patch
+i2c-use-parent-adapter-quirks-in-mux.patch
+iio-light-cm3323-clear-bitmask-before-set.patch
+iio-adc-cc10001_adc-fix-kconfig-dependency.patch
+iio-accel-bmc150-accel-fix-counting-direction.patch
+iio-light-tcs3414-fix-bug-preventing-to-set-integration-time.patch
+iio-dac-ad5624r_spi-fix-bit-shift-of-output-data-value.patch
+iio-inv-mpu-specify-the-expected-format-precision-for-write-channels.patch
+iio-tmp006-check-channel-info-on-write.patch
+iio-twl4030-madc-pass-the-irqf_oneshot-flag.patch
+iio-abi-clarify-proximity-output-value.patch
+iio-proximity-sx9500-fix-proximity-value.patch
+iio-adc-rockchip_saradc-add-missing-module_-data.patch
+iio-adc-at91_adc-allow-to-use-full-range-of-startup-time.patch
+vb2-don-t-warn-when-v4l2_buffer.bytesused-is-0-for-multiplanar-buffers.patch
+media-fix-regression-in-some-more-dib0700-based-devices.patch
+rc-core-fix-dib0700-scancode-generation-for-rc5.patch
+cx18-add-missing-caps-for-the-pcm-video-device.patch
+cx24117-fix-a-buffer-overflow-when-checking-userspace-params.patch
+af9013-don-t-accept-invalid-bandwidth.patch
+saa7164-fix-querycap-warning.patch
+s5h1420-fix-a-buffer-overflow-when-checking-userspace-params.patch
+cx24116-fix-a-buffer-overflow-when-checking-userspace-params.patch
+asoc-arizona-fix-noise-generator-gain-tlv.patch
+asoc-rt5645-init-jack_detect_work-before-registering-irq.patch
+asoc-max98925-fix-mask-for-setting-dai-invert-mode.patch
+asoc-qcom-remove-incorrect-dependencies.patch
+asoc-imx-wm8962-add-a-missing-error-check.patch
+asoc-omap-fix-up-snd_omap_soc_omap_abe_twl6040-dependency-again.patch
+asoc-wm8737-fixup-setting-vmid-impedance-control-register.patch
+asoc-wm8955-fix-setting-wrong-register-for-wm8955_k_8_0_mask-bits.patch
+asoc-wm8903-fix-define-for-wm8903_vmid_res_250k.patch
+asoc-wm8960-the-enum-of-dac-polarity-should-be-wm8960_enum.patch
+asoc-tas2552-fix-kernel-crash-when-the-codec-is-loaded-but-not-part-of-a-card.patch
+asoc-tas2552-fix-kernel-crash-caused-by-wrong-kcontrol-entry.patch
+libata-do-not-blacklist-micron-m500dc.patch
+libata-add-ata_horkage_broken_fpdma_aa-quirk-for-hp-250gb-sata-disk-vb0250eaver.patch
+libata-increase-the-timeout-when-setting-transfer-mode.patch
+libata-fall-back-to-unqueued-read-log-ext-if-the-dma-variant-fails.patch
+libata-expose-trim-capability-in-sysfs.patch
+libata-add-ata_horkage_notrim.patch
+libata-add-ata_horkage_max_sec_1024-to-revert-back-to-previous-max_sectors-limit.patch
+libata-do-not-blacklist-m510dc.patch
+libata-force-disable-trim-for-supersspeed-s238.patch
--- /dev/null
+From b08ad6657aacf9b5d7c4b22de2ba891b152d0528 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Fri, 12 Jun 2015 16:37:41 +0100
+Subject: staging: comedi: cb_pcimdas: fix handlers for DI and DO subdevices
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit b08ad6657aacf9b5d7c4b22de2ba891b152d0528 upstream.
+
+Normally, low-level Comedi drivers set an `insn_bits` handler for
+digital input (DI), digital output (DO) and digital input/output (DIO)
+subdevice types to handle normal reading and writing of digital
+channels. The "cb_pcimdas" driver currently has an `insn_read` handler
+for the DI subdevice and an `insn_write` handler for the DO subdevice.
+However, the actual handler functions `cb_pcimdas_di_insn_read()` and
+`cb_pcimdas_do_insn_write()` are written to behave like `insn_bits`
+handlers. Something's wrong there! To fix it, set the functions as
+`insn_bits` handlers and rename them for consistency.
+
+Fixes: e56d03dee14a ("staging: comedi: cb_pcimdas: add main connector digital input/output")
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/cb_pcimdas.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/comedi/drivers/cb_pcimdas.c
++++ b/drivers/staging/comedi/drivers/cb_pcimdas.c
+@@ -243,7 +243,7 @@ static int cb_pcimdas_ao_insn_write(stru
+ return insn->n;
+ }
+
+-static int cb_pcimdas_di_insn_read(struct comedi_device *dev,
++static int cb_pcimdas_di_insn_bits(struct comedi_device *dev,
+ struct comedi_subdevice *s,
+ struct comedi_insn *insn,
+ unsigned int *data)
+@@ -258,7 +258,7 @@ static int cb_pcimdas_di_insn_read(struc
+ return insn->n;
+ }
+
+-static int cb_pcimdas_do_insn_write(struct comedi_device *dev,
++static int cb_pcimdas_do_insn_bits(struct comedi_device *dev,
+ struct comedi_subdevice *s,
+ struct comedi_insn *insn,
+ unsigned int *data)
+@@ -424,7 +424,7 @@ static int cb_pcimdas_auto_attach(struct
+ s->n_chan = 4;
+ s->maxdata = 1;
+ s->range_table = &range_digital;
+- s->insn_read = cb_pcimdas_di_insn_read;
++ s->insn_bits = cb_pcimdas_di_insn_bits;
+
+ /* Digital Output subdevice (main connector) */
+ s = &dev->subdevices[4];
+@@ -433,7 +433,7 @@ static int cb_pcimdas_auto_attach(struct
+ s->n_chan = 4;
+ s->maxdata = 1;
+ s->range_table = &range_digital;
+- s->insn_write = cb_pcimdas_do_insn_write;
++ s->insn_bits = cb_pcimdas_do_insn_bits;
+
+ /* Counter subdevice (8254) */
+ s = &dev->subdevices[5];
--- /dev/null
+From cab462140f8a183e3cca0b51c8b59ef715cb6148 Mon Sep 17 00:00:00 2001
+From: Haggai Eran <haggai.eran@gmail.com>
+Date: Sat, 23 May 2015 23:13:51 +0300
+Subject: staging: rtl8712: prevent buffer overrun in recvbuf2recvframe
+
+From: Haggai Eran <haggai.eran@gmail.com>
+
+commit cab462140f8a183e3cca0b51c8b59ef715cb6148 upstream.
+
+With an RTL8191SU USB adaptor, sometimes the hints for a fragmented
+packet are set, but the packet length is too large. Allocate enough
+space to prevent memory corruption and a resulting kernel panic [1].
+
+[1] http://www.spinics.net/lists/linux-wireless/msg136546.html
+
+Signed-off-by: Haggai Eran <haggai.eran@gmail.com>
+ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8712/rtl8712_recv.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/rtl8712/rtl8712_recv.c
++++ b/drivers/staging/rtl8712/rtl8712_recv.c
+@@ -1056,7 +1056,8 @@ static int recvbuf2recvframe(struct _ada
+ /* for first fragment packet, driver need allocate 1536 +
+ * drvinfo_sz + RXDESC_SIZE to defrag packet. */
+ if ((mf == 1) && (frag == 0))
+- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
++ /*1658+6=1664, 1664 is 128 alignment.*/
++ alloc_sz = max_t(u16, tmp_len, 1658);
+ else
+ alloc_sz = tmp_len;
+ /* 2 is for IP header 4 bytes alignment in QoS packet case.
--- /dev/null
+From 8e8e9198920ddfa920191069ae02eba75d39e653 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Thu, 9 Jul 2015 17:01:24 +0100
+Subject: staging: vt6655: check ieee80211_bss_conf bssid not NULL
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 8e8e9198920ddfa920191069ae02eba75d39e653 upstream.
+
+Sometimes bssid can go null on failed association.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6655/device_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -1417,7 +1417,7 @@ static void vnt_bss_info_changed(struct
+
+ priv->current_aid = conf->aid;
+
+- if (changed & BSS_CHANGED_BSSID) {
++ if (changed & BSS_CHANGED_BSSID && conf->bssid) {
+ unsigned long flags;
+
+ spin_lock_irqsave(&priv->lock, flags);
--- /dev/null
+From b5eeed8cb6097c8ea660b6598d36fdbb94065a22 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Sun, 31 May 2015 10:35:28 +0100
+Subject: staging: vt6655: device_rx_srv check sk_buff is NULL
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit b5eeed8cb6097c8ea660b6598d36fdbb94065a22 upstream.
+
+There is a small chance that pRD->pRDInfo->skb could go NULL
+while the interrupt is processing.
+
+Put NULL check on loop to break out.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6655/device_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -807,6 +807,10 @@ static int device_rx_srv(struct vnt_priv
+ pRD = pRD->next) {
+ if (works++ > 15)
+ break;
++
++ if (!pRD->pRDInfo->skb)
++ break;
++
+ if (vnt_receive_frame(pDevice, pRD)) {
+ if (!device_alloc_rx_buf(pDevice, pRD)) {
+ dev_err(&pDevice->pcid->dev,
--- /dev/null
+From d309509f84725f99326cc73d3b00aae096b374ae Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Thu, 9 Jul 2015 17:03:57 +0100
+Subject: staging: vt6656: check ieee80211_bss_conf bssid not NULL
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit d309509f84725f99326cc73d3b00aae096b374ae upstream.
+
+Sometimes bssid can go null on failed association.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/main_usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -701,7 +701,7 @@ static void vnt_bss_info_changed(struct
+
+ priv->current_aid = conf->aid;
+
+- if (changed & BSS_CHANGED_BSSID)
++ if (changed & BSS_CHANGED_BSSID && conf->bssid)
+ vnt_mac_set_bssid_addr(priv, (u8 *)conf->bssid);
+
+
--- /dev/null
+From 77a3c6fd90c94f635edb00d4a65f485687538791 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Date: Fri, 19 Jun 2015 08:50:07 -0300
+Subject: [media] vb2: Don't WARN when v4l2_buffer.bytesused is 0 for multiplanar buffers
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+commit 77a3c6fd90c94f635edb00d4a65f485687538791 upstream.
+
+Commit f61bf13b6a07 ("[media] vb2: add allow_zero_bytesused flag to the
+vb2_queue struct") added a WARN_ONCE to catch usage of a deprecated API
+using a zero value for v4l2_buffer.bytesused.
+
+However, the condition is checked incorrectly, as the v4L2_buffer
+bytesused field is supposed to be ignored for multiplanar buffers. This
+results in spurious warnings when using the multiplanar API.
+
+Fix it by checking v4l2_buffer.bytesused for uniplanar buffers and
+v4l2_plane.bytesused for multiplanar buffers.
+
+Fixes: f61bf13b6a07 ("[media] vb2: add allow_zero_bytesused flag to the vb2_queue struct")
+
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/videobuf2-core.c | 33 +++++++++++++++++++++----------
+ 1 file changed, 23 insertions(+), 10 deletions(-)
+
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -1237,6 +1237,23 @@ void vb2_discard_done(struct vb2_queue *
+ }
+ EXPORT_SYMBOL_GPL(vb2_discard_done);
+
++static void vb2_warn_zero_bytesused(struct vb2_buffer *vb)
++{
++ static bool __check_once __read_mostly;
++
++ if (__check_once)
++ return;
++
++ __check_once = true;
++ __WARN();
++
++ pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n");
++ if (vb->vb2_queue->allow_zero_bytesused)
++ pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n");
++ else
++ pr_warn_once("use the actual size instead.\n");
++}
++
+ /**
+ * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a
+ * v4l2_buffer by the userspace. The caller has already verified that struct
+@@ -1247,16 +1264,6 @@ static void __fill_vb2_buffer(struct vb2
+ {
+ unsigned int plane;
+
+- if (V4L2_TYPE_IS_OUTPUT(b->type)) {
+- if (WARN_ON_ONCE(b->bytesused == 0)) {
+- pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n");
+- if (vb->vb2_queue->allow_zero_bytesused)
+- pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n");
+- else
+- pr_warn_once("use the actual size instead.\n");
+- }
+- }
+-
+ if (V4L2_TYPE_IS_MULTIPLANAR(b->type)) {
+ if (b->memory == V4L2_MEMORY_USERPTR) {
+ for (plane = 0; plane < vb->num_planes; ++plane) {
+@@ -1297,6 +1304,9 @@ static void __fill_vb2_buffer(struct vb2
+ struct v4l2_plane *pdst = &v4l2_planes[plane];
+ struct v4l2_plane *psrc = &b->m.planes[plane];
+
++ if (psrc->bytesused == 0)
++ vb2_warn_zero_bytesused(vb);
++
+ if (vb->vb2_queue->allow_zero_bytesused)
+ pdst->bytesused = psrc->bytesused;
+ else
+@@ -1331,6 +1341,9 @@ static void __fill_vb2_buffer(struct vb2
+ }
+
+ if (V4L2_TYPE_IS_OUTPUT(b->type)) {
++ if (b->bytesused == 0)
++ vb2_warn_zero_bytesused(vb);
++
+ if (vb->vb2_queue->allow_zero_bytesused)
+ v4l2_planes[0].bytesused = b->bytesused;
+ else
projects / thirdparty / kernel / stable-queue.git / commitdiff
